CVE-2026-90872 in WS_FTP Server
Summary
by MITRE • 10/29/2026
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Progress Software WS_FTP Server represents a critical security flaw rooted in improper neutralization of user-supplied input within dynamically evaluated code, specifically affecting the Manager web console interface. This issue is prevalent in versions prior to 2024.0.7 and 2025.0.4 running on Windows operating systems. The core technical deficiency lies in how the application processes directives or parameters that are subsequently passed into a dynamic execution context without adequate sanitization or validation. In software engineering terms, this aligns with CWE-95, commonly known as Improper Neutralization of Directives in Dynamically Evaluated Code, often referred to more broadly under the umbrella of Server-Side Request Forgery (SSRF) if it involves external requests, or Command Injection if it leads to OS-level execution. In this specific instance, the dynamic evaluation mechanism fails to distinguish between legitimate configuration directives and maliciously crafted input strings that contain executable code fragments.
The operational impact of this vulnerability is severe due to the privilege level associated with the affected component. The WS_FTP Server Manager web console typically operates under the context of an authenticated administrator account. When such a user interacts with vulnerable endpoints, they can inject commands into the dynamic evaluation engine. Because the underlying process runs as the IIS worker process identity, successful exploitation allows for arbitrary command execution at the system level with the privileges granted to that specific service account. This effectively grants an attacker full control over the server infrastructure hosting WS_FTP Server, provided they possess valid administrative credentials for the web console. The ability to execute commands means potential consequences include data exfiltration, lateral movement within a network, installation of persistent backdoors, or complete system compromise depending on the permissions assigned to the IIS worker process identity.
From an attack vector perspective, this vulnerability is classified under MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically relating to operating system command execution via web application interfaces. It also touches upon T1190, Exploit Public-Facing Application, although the requirement for authentication narrows the scope significantly compared to unauthenticated remote code execution vulnerabilities. The threat model suggests that insider threats or compromised administrative accounts pose the highest risk profile here. An attacker does not need complex external exploits; rather, they leverage existing access credentials to manipulate internal application logic through crafted HTTP requests targeting the dynamic evaluation endpoints of the Manager console.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Organizations running affected versions should upgrade immediately to WS_FTP Server version 2024.0.7 or later, where Progress Software has implemented fixes for this input validation flaw. In scenarios where upgrading is not immediately feasible due to operational constraints, defensive measures should focus on strict access control and network segmentation. The Manager web console interface should be restricted to trusted management networks only, ensuring that it is not exposed directly to the internet or untrusted internal subnets. Additionally, implementing Web Application Firewall rules can help detect and block patterns associated with command injection attempts, such as common shell metacharacters or suspicious payload structures in HTTP parameters. Regular auditing of administrative account activity logs should also be enforced to identify any unauthorized usage of the Manager console that might indicate exploitation attempts.