CVE-2026-90862 in WS_FTP Server
Summary
by MITRE • 10/29/2026
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Progress Software WS_FTP Server represents a critical failure in the implementation of multi-factor authentication (MFA) controls within the Web Transfer Module. This flaw affects versions prior to 2024.0.7 and 2025.0.4 running on Windows operating systems. The core issue lies in how the application validates user credentials during specific web-based file transfer operations. While the system is configured to enforce MFA for general access, a logic error allows an attacker who has already obtained valid primary authentication credentials, such as a username and password, to bypass the secondary factor requirement when accessing certain files associated with that account. This discrepancy creates a significant security gap where the strength of the overall authentication mechanism is undermined by inconsistent enforcement across different modules or endpoints within the same application.
From a technical perspective, this flaw constitutes an improper authentication vulnerability, specifically categorized under CWE-287: Improper Authentication. The attacker does not need to exploit a buffer overflow or injection technique but rather exploits the logical flow of the authentication process. Once the initial password is validated, the Web Transfer Module fails to verify that the secondary factor has been successfully presented and accepted before granting access to sensitive resources. This allows for credential-based attacks where compromised passwords can be leveraged directly without needing to compromise additional hardware tokens or mobile authenticator apps. The vulnerability highlights a common architectural weakness in legacy enterprise applications where security controls are not uniformly applied across all entry points, particularly when web interfaces interact with backend file systems.
The operational impact of this vulnerability is severe for organizations relying on WS_FTP Server for secure data exchange. An attacker who has compromised user credentials through phishing, brute force, or credential stuffing attacks can gain unauthorized access to sensitive files without detection by MFA monitoring tools that typically flag missing secondary factors. This bypass effectively nullifies the primary defense mechanism intended to protect against stolen passwords. Consequently, confidential business documents, personally identifiable information, and proprietary data stored within the FTP server become accessible to malicious actors. The risk is exacerbated in environments where users may have weak or reused passwords, as the MFA layer provides no additional protection for these specific file access operations.
This vulnerability aligns with MITRE ATT&CK technique T1078: Valid Accounts, specifically sub-technique T1078.001: Default Accounts if default credentials are used, but more accurately reflects general valid account abuse where the attacker leverages legitimate credentials to bypass security controls. It also relates to CWE-352: Cross-Site Request Forgery in contexts where session management might be involved, though the primary issue is authentication logic rather than request forgery per se. The failure to enforce MFA consistently across all modules violates best practices outlined in NIST SP 800-63B regarding digital identity guidelines, which mandate that multi-factor requirements must apply uniformly to all access methods and resource types associated with a given security level.
To mitigate this risk, organizations running affected versions of WS_FTP Server should immediately upgrade to version 2024.0.7 or later for the legacy branch, or version 2025.0.4 and above for the newer release line, where Progress Software has addressed the authentication logic flaw in the Web Transfer Module. Until patching is complete, administrators should consider disabling web-based file transfer access if not strictly required, restricting network access to the FTP server interface to trusted IP ranges only, and implementing strict monitoring for anomalous login patterns that might indicate credential compromise. Additionally, enforcing strong password policies and ensuring that MFA is enabled for all users can reduce the likelihood of initial credential theft, although it does not fully mitigate this specific bypass vulnerability until the software is updated. Regular security audits should also verify that authentication controls are consistently enforced across all application modules to prevent similar logical flaws in other areas of the system.