FlagThis
← Back to CVE List
Vulnerability Intelligence Report
OS Command Injection in Progress WS_FTP Server

CVE-2026-90868

An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

Injection No Active Exploit Signals
CVSS Base Score
9.9
CRITICAL
Exploitability:3.2
Impact Score:6.1
EPSS Probability:1.49%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Weaknesses (CWE)

CWE-78 ↗CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88 ↗CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products & Versions

Vendor Product Affected Versions
Progress Software WS_FTP Server 0 < 2024.0.7 (affected), 0 < 2025.0.4 (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
1.493%
GitHub Advisory
GHSA-w9jf-9hg2-6mgp ↗
Vulnerability Class
Injection

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityProgress Software Corporation · Vendor · USA
Reserved2026-09-14T06:09:55
Published2026-10-29T15:53:59
Last Updated2026-10-30T17:18:24

Related Intelligence

Related CVEs
CVE-2026-84295 CVSS 10.0 — Improper authentication in Progress Software WS_FTP Server versions pr…
CVE-2023-40044 CVSS 10.0 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticate…
CVE-2023-42657 CVSS 9.9 — In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory tra…
CVE-2026-90866 CVSS 9.1 — A path traversal vulnerability in Progress Software WS_FTP Server vers…
CVE-2026-90864 CVSS 9.1 — A path traversal vulnerability in Progress Software WS_FTP Server vers…
LINK COPIED TO CLIPBOARD