CVE-2026-90865

CRITICAL

INFO Priority: 0.00 BB Relevance: 68/100

Published: 2026-10-29 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network No Auth No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network

AC: High

PR: None

UI: None

S: Changed

C: High

I: High

A: High

Description

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

Weakness Classification (2)

CWE-78 — CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-88 — CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Software (2)

Vendor	Product	Version
Progress Software	WS_FTP Server	0 < 2024.0.7
Progress Software	WS_FTP Server	0 < 2025.0.4

References & Advisories (1)

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

vendor-advisory

Bug Bounty Relevance

68 / 100

✓ Network accessible
✓ No authentication
✓ No user interaction

CVSS Score

9.0 / 10.0 v3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploitation Probability

No EPSS data available

Intelligence Sources

mitre ref →

nvd ref →

External Links

NVD (NIST) CVE Details FIRST EPSS API OSV.dev