CVE-2026-90863 in WS_FTP Server
Summary
by MITRE • 10/29/2026
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 represents a critical failure in access control mechanisms within the administrative interface on Windows platforms. This flaw is classified under CWE-862, which denotes Missing Authorization, indicating that the application fails to properly verify whether an authenticated user has the necessary permissions to perform specific actions or access certain resources. In this context, the vulnerability specifically affects users who have been assigned the role of Host Administrator. While these accounts are intended to manage host-level configurations and operations within a multi-tenant environment, they should not possess privileges that allow them to execute commands at the system level with elevated rights beyond their designated scope. The absence of strict enforcement mechanisms allows this specific user class to bypass expected restrictions, leading to a significant escalation of privilege.
From an operational perspective, the impact of this vulnerability is severe and potentially catastrophic for organizations relying on WS_FTP Server for secure file transfer operations. A delegated Host Administrator can exploit this missing authorization check to execute arbitrary commands with elevated privileges, effectively gaining control over the underlying server operating system. This capability transforms a limited administrative account into a full system compromise vector. An attacker leveraging this flaw could install malware, exfiltrate sensitive data stored on the server, modify system configurations, or use the compromised server as a pivot point for further attacks against other network resources. The ability to execute arbitrary commands means that confidentiality, integrity, and availability of the entire service are jeopardized, undermining the primary purpose of deploying an enterprise-grade FTP solution.
This vulnerability aligns with MITRE ATT&CK technique T1068, which covers Exploitation for Privilege Escalation, as it involves leveraging a software flaw to gain higher-level permissions than originally granted. It also relates to CWE-250, where the attacker executes code with elevated privileges that are not intended for them. The root cause lies in the design of the administrative interface logic, which likely relies on client-side checks or insufficient server-side validation when processing requests from Host Administrators. Without rigorous input validation and explicit permission verification at every step of command execution, the application trusts user-supplied data regarding their own authority level, a common pitfall in legacy enterprise applications that have not undergone recent security refactoring to address modern threat models.
To mitigate this risk, organizations running affected versions must immediately upgrade Progress Software WS_FTP Server to version 2024.0.7 or later, where the authorization checks have been corrected to enforce proper role-based access control boundaries. Until an update can be applied, administrators should implement network-level controls such as firewalls and intrusion detection systems to restrict access to the administrative interface exclusively from trusted IP addresses. Additionally, enforcing strict least-privilege principles is crucial; Host Administrator accounts should not be assigned to individuals who do not require extensive host management capabilities. Regular auditing of user roles and permissions can help identify any misconfigurations that might exacerbate this vulnerability. Monitoring logs for unusual command execution patterns or privilege escalation attempts by administrative users can also provide early detection indicators while patching efforts are underway.