Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Progress WS_FTP Server web admin can be accessed remotely

CVE-2026-90867 · published 6 days ago
Summary

The web‑based administration console in Progress WS_FTP Server (versions before 2024.0.7 and 2025.0.4 on Windows) does not correctly restrict who can reach it. This could let an outsider try to log in and potentially control the server. Upgrade to the latest version or apply the vendor’s patch to lock down the console.

What to do
  • Update progress software ws_ftp server to version 2024.0.7 or later.
Affected software
VendorProductAffected versions
progress software ws_ftp server < 2024.0.7
Original advisory text
Improper Access Control of Web Admin Console in Progress WS_FTP Server
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published29 Oct 2026
Updated4 Nov 2026
First seen29 Oct 2026
Sources
CVE-2026-90867 · NVD
CVE-2026-90867 · MITRE
Track software like this
Free during beta