CVE-2026-90865

Published Oct 29, 2026

Last updated 8 days ago

CVSS critical 9.0
Port (21)

Overview

Description
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
Source
security@progress.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9
Impact score
6
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security@progress.com
CWE-78

Social media

Hype score
Not currently trending

  1. 🔴 Critical · Patched Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4 CVE-2026-90868, CVE-2026-90865 +12 more https://t.co/hNhnltPJV4

    @pwnwatch_app

    29 Oct 2026

    74 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.•CVE-2026-90868
  2. Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.•CVE-2026-84295
  3. ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.•CVE-2026-63090
  4. Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.•CVE-2026-47729
  5. Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.•CVE-2026-49172

References

Sources include official advisories and independent security research.