CVE-2026-90865 in WS_FTP Server
Summary
by MITRE • 10/29/2026
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw represents a critical operating system command injection vulnerability within the Progress Software WS_FTP Server application, specifically affecting versions released prior to patches 2024.0.7 and 2025.0.4 on Windows platforms. This type of vulnerability arises when an application fails to properly validate or sanitize user-supplied input before incorporating it into system-level commands executed by the operating system shell. In this specific instance, the flaw allows an attacker who can interact with the WS_FTP Server interface to inject malicious command sequences that are subsequently interpreted and executed by the underlying Windows OS. The severity of this issue is significantly amplified because the vulnerability enables arbitrary command execution under elevated privileges, meaning the injected commands run with the same high-level permissions as the service account or user context running the WS_FTP application, often granting access equivalent to local administrator rights depending on the deployment configuration.
From a technical perspective, OS command injection vulnerabilities typically stem from improper handling of special characters such as semicolons, ampersands, pipes, and backticks within input fields that are passed directly to system shells like cmd.exe or powershell.exe without adequate escaping or parameterization. When an attacker successfully exploits this weakness, they can bypass application-level security controls to execute any command supported by the host operating system. This capability allows for a wide range of malicious activities including but not limited to creating new user accounts with administrative privileges, disabling security software such as firewalls and antivirus solutions, exfiltrating sensitive data from the file system, installing backdoors or remote access trojans, and pivoting to other systems within the internal network. The impact is particularly severe in enterprise environments where WS_FTP Server may be integrated into broader IT infrastructure, potentially leading to a complete compromise of the host server and lateral movement across the network domain.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, which describes how adversaries use operating system command line interfaces or scripting languages like PowerShell to execute commands on a target machine. The exploitation path likely involves initial access through valid credentials or unauthenticated endpoints if the service is exposed improperly, followed by privilege escalation via the injected OS commands due to the elevated execution context of the WS_FTP Server process. Understanding these mappings helps security teams prioritize remediation efforts and align their detection strategies with established threat intelligence frameworks.
To mitigate this risk, organizations must immediately apply the vendor-released patches upgrading to version 2024.0.7 or later for the respective release branches. Until patching is feasible, administrators should implement strict network segmentation to restrict access to WS_FTP Server management interfaces and data ports from untrusted networks. Additionally, enforcing least privilege principles by running the service under a dedicated low-privilege account rather than an administrative one can significantly reduce the blast radius of any successful exploitation attempt. Input validation mechanisms at the application layer should be reviewed to ensure that all user inputs are strictly validated against allowlists and that special characters are properly escaped or encoded before being passed to system commands. Regular vulnerability scanning and continuous monitoring for anomalous process executions originating from the WS_FTP service account will further enhance detection capabilities and response times in case of attempted exploitation.