Progress has identified 15 security vulnerabilities in the WS_FTP Server, potentially exposing administrative credentials, allowing for arbitrary operating system command execution, and disrupting file transfer services This article explores security vulnerabilities ws_ftp. . Severe Security Vulnerabilities in WS_FTP Server An unauthenticated attacker can exploit improper authentication, gaining access to sensitive information such as administrator credentials, potentially leading to a broader compromise.
CVE-2026-90866 addresses virtual folder path confinement, whereas CVE-2026-90864 involves host administrator path containment.
CVE-2026-90863 is rated 9.1 and includes a missing authorization issue in the WS_FTP Manager, enabling delegated administrators to exceed their designated privileges. Other vulnerabilities involve improper access control in the Web Admin console, exposure of passwords through activity logs, and server-side script injection in the Manager interface. Separate authentication flaws exist for SSH and the Web Transfer Module, potentially bypassing multifactor authentication checks under certain circumstances.
CVE-2026-90870 allows resource exhaustion through repeated unauthenticated requests due to unused backend receiver sessions.
Another pathname restriction flaw, CVE-2026-90871, enables file deletion outside intended directories under specific conditions. Progress identifies WS_FTP Server 2024.0.7, internally numbered 9.0.7, and 2025.0.4, internally numbered 10.0.4, as releases addressing the complete vulnerability set. Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
