Vulnerability · Published Oct 29, 2026 · Assigned by ProgressSoftware

CVE-2026-90863Privilege Escalation via Missing Authorization in WS_FTP Manager

Critical 9.1

In plain English

A critical-severity missing authorization in WS_FTP Server from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 48.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	WS_FTP Server	0 – before 2024.0.70 – before 2025.0.4

Weakness: CWE-915, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view vendor-advisory