SB20261029219 - Multiple vulnerabilities in Progress WS_FTP Server
Published: October 29, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-90863)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to escalate privileges and perform actions beyond their intended administrative scope.
The vulnerability exists due to missing authorization and improperly controlled modification of dynamically determined object attributes in WS_FTP Manager when handling administrative changes. A remote privileged user can modify attributes without the required authorization checks to perform actions beyond their delegated privileges.
2) OS Command Injection (CVE-ID: CVE-2026-90865)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary operating-system commands.
The vulnerability exists due to improper neutralization of operating-system command elements and argument delimiters in the FTP notification functionality of Progress WS_FTP Server when incorporating notification variables into commands. A remote user can supply crafted values for FTP notification variables under specific configuration conditions to execute arbitrary operating-system commands.
3) OS Command Injection (CVE-ID: CVE-2026-90868)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary operating-system commands.
The vulnerability exists due to improper neutralization of operating-system command elements and argument delimiters in Progress WS_FTP Server when constructing commands from externally supplied input. A remote user can supply crafted command input under specific configuration conditions to execute arbitrary operating-system commands.
4) Eval Injection (CVE-ID: CVE-2026-90872)
CWE-ID: CWE-95 - Eval Injection
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary server-side code and commands.
The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in the Manager web interface of Progress WS_FTP Server when processing administrative input. A remote privileged user can submit crafted script directives through the administrative interface to execute arbitrary server-side code and commands.
5) Improper access control (CVE-ID: CVE-2026-90867)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to reach the administrative console from untrusted networks.
The vulnerability exists due to improper access control in the Web Admin console of Progress WS_FTP Server when handling connections under the default configuration. A remote attacker can connect from an untrusted network to reach an administrative interface that should be restricted.
6) Path traversal (CVE-ID: CVE-2026-84294)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to access files outside their authorized scope and disclose sensitive information.
The vulnerability exists due to path traversal in the Ad Hoc Transfer component of Progress WS_FTP Server when handling file access requests. A remote user can submit a crafted file path to access files outside their authorized scope.
7) Path traversal (CVE-ID: CVE-2026-90866)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to bypass virtual folder confinement and potentially access or modify files outside their assigned scope.
The vulnerability exists due to path traversal and insufficient restrictions on dangerous file uploads in the virtual folder functionality of Progress WS_FTP Server when handling file paths and uploads. A remote privileged user can supply paths outside the intended virtual folder boundary to potentially access or modify files beyond their assigned scope.
8) Path traversal (CVE-ID: CVE-2026-90871)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to delete files outside the intended directory.
The vulnerability exists due to path traversal in the Ad Hoc Transfer and Web Transfer components of Progress WS_FTP Server when processing file deletion paths. A remote attacker can submit a crafted path under specific conditions to delete files outside the intended directory.
9) Path traversal (CVE-ID: CVE-2026-90864)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to bypass host administrator path restrictions and potentially access or modify files outside their authorized scope.
The vulnerability exists due to path traversal and insufficient restrictions on dangerous file uploads in the host administration functionality of Progress WS_FTP Server when handling file paths and uploads. A remote privileged user can supply paths that escape the intended containment boundary to potentially access or modify files outside their authorized scope.
10) Out-of-bounds read (CVE-ID: CVE-2026-90869)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service in the SSH service.
The vulnerability exists due to an out-of-bounds read in the SSH authentication functionality of Progress WS_FTP Server when processing malformed public-key signatures before authentication. A remote attacker can send specially crafted authentication data to disrupt the SSH service.
11) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90870)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to exhaust server resources and cause a denial of service.
The vulnerability exists due to failure to release resources after their effective lifetime in the Ad Hoc Transfer component of Progress WS_FTP Server when handling requests. A remote attacker can send repeated unauthenticated requests to exhaust server resources and cause a denial of service.
12) Improper Authentication (CVE-ID: CVE-2026-84295)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication and potentially gain unauthorized access.
The vulnerability exists due to improper authentication and insufficient protection of credentials in Progress WS_FTP Server when handling authentication. A remote attacker can exploit these weaknesses to potentially gain access without satisfying the intended authentication requirements.
13) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-90861)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to obtain privileged passwords and escalate administrative privileges.
The vulnerability exists due to insertion of sensitive credentials into activity logs in Progress WS_FTP Server when recording activity. A remote privileged user can read exposed privileged passwords in accessible activity logs and use them to gain greater administrative privileges.
14) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-84296)
CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass multi-factor authentication and potentially gain unauthorized account access.
The vulnerability exists due to an incorrectly implemented authentication algorithm in the SSH service of Progress WS_FTP Server when performing multi-factor authentication. A remote user can exploit the affected authentication flow under specific conditions to bypass multi-factor verification and potentially gain unauthorized account access.
15) Use of Single-factor Authentication (CVE-ID: CVE-2026-90862)
CWE-ID: CWE-308 - Use of Single-factor Authentication
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass multi-factor authentication and potentially access files in the affected account.
The vulnerability exists due to reliance on single-factor authentication in the Web Transfer Module of Progress WS_FTP Server when enforcing multi-factor verification. A remote user can exploit the affected authentication flow under specific conditions to access account files without completing the additional authentication factor.
Remediation
Install update from vendor's website.