CVE-2026-90863

Privilege Escalation via Missing Authorization in WS_FTP Manager

State: Published
Severity: 9.1 Critical
Published: Oct 29, 2026
Updated: Oct 30, 2026
Reserved: Sep 14, 2026

Description

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	ProgressSoftware

Weaknesses

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-862 Missing Authorization

Affected Products

Product	Versions
WS_FTP ServerProgress Software	before 2024.0.7Affected before 2025.0.4Affected

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/viewvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.