Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could…
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Progress Software
- Product
- WS_FTP Server
- CVSS v3.1
- 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.007 (p51)
- Weakness
- CWE-862, CWE-915
- Exposure class
- File transfer
- NVD status
- Awaiting Analysis
Why it ranks 36 (Notable)
- CVSS v3.1 9.1 critical
- Exposed product class: file transfer
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-90863 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.