CVE-2026-90867 in WS_FTP Server
Summary
by MITRE • 10/29/2026
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified as an improper access control flaw within the Web Admin console of Progress Software WS_FTP Server represents a critical security deficiency that undermines the fundamental principle of least privilege for administrative interfaces. This issue affects versions prior to 2024.0.7 and 2025.0.4 running on Windows operating systems. The core technical flaw lies in the authentication mechanism or session management logic, which fails to properly enforce access restrictions before validating user credentials against administrative functionality endpoints. Consequently, remote attackers can interact with sensitive administrative features without first establishing a valid authenticated session. This misconfiguration effectively bypasses the intended security boundary that separates unauthenticated users from privileged system operations, allowing external entities to probe and potentially exploit administrative controls directly through network requests.
From an operational perspective, this vulnerability significantly expands the attack surface of the WS_FTP Server infrastructure by exposing high-privilege functions to remote authentication attempts. An attacker leveraging this flaw can enumerate valid usernames, attempt brute-force attacks against administrator accounts with reduced risk of detection or lockout mechanisms that might otherwise trigger upon unauthorized access attempts to non-administrative pages. Furthermore, if weak credentials are in use, the attacker may gain full control over the server environment. This level of access enables the modification of file transfer policies, creation of new user accounts with elevated privileges, and potentially the execution of arbitrary commands depending on how the administrative console integrates with underlying system processes. The exposure also facilitates lateral movement within a network if the WS_FTP Server is integrated with other internal services or directory systems, as compromised credentials can be used to pivot to additional assets.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-306 Missing Authentication for Critical Function, which describe scenarios where access control checks are insufficiently enforced on critical operations. In the context of the MITRE ATT&CK framework, this flaw facilitates techniques related to Credential Access such as Brute Force (T1110) and potentially Account Manipulation (T1098) if an attacker successfully authenticates via the exposed administrative interface. The lack of proper access control prior to authentication allows attackers to bypass initial security layers that are designed to limit exposure, thereby increasing the likelihood of successful compromise through credential-based attacks or session hijacking techniques.
To mitigate this risk, organizations must immediately upgrade WS_FTP Server to version 2024.0.7 or later for the 2024 branch and version 2025.0.4 or later for the 2025 branch, as these releases contain patches that enforce proper access control checks before allowing interaction with administrative endpoints. In addition to applying vendor-provided updates, administrators should implement network-level restrictions by limiting access to the Web Admin console exclusively to trusted IP addresses using firewall rules or reverse proxy configurations. Enforcing multi-factor authentication for all administrative accounts adds a critical layer of defense against credential-based attacks that may succeed due to this vulnerability. Regular security audits and penetration testing focused on web application access controls are also recommended to identify similar misconfigurations across other managed services within the infrastructure.