- Description
- An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
- Source
- security@progress.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 9.9
- Impact score
- 6
- Exploitability score
- 3.1
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- security@progress.com
- CWE-78
- Hype score
- Not currently trending
🔥 CyberForge CVE of the Day #091 🚨 CVE-2026-84295 / CVE-2026-90868 — Progress WS_FTP Server: credential exposure and conditional command injection Administrator-credential exposure and command injection are an uncomfortable pairing on a file-transfer server. They requir
@lee1981b
30 Oct 2026
147 Impressions
1 Retweet
3 Likes
0 Bookmarks
1 Reply
0 Quotes
#NØØT_Security_Alerts 🚨 #ALERT — Critical Command Injection in Progress WS_FTP Server October 29, 2026 PRODUCT: Progress Software WS_FTP Server for Windows. CVE: CVE-2026-90868. SEVERITY: CRITICAL — CVSS 9.9. AFFECTED VERSIONS: Before 2024.0.7 in the 2024 branch and be
@Python_s_
30 Oct 2026
47 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🔴 Critical · Patched Progress WS_FTP Server: unauthenticated admin credential exposure (CVE-2026-84295, CVSS 10) and OS command injection, fixed in 2024.0.7 and 2025.0.4 CVE-2026-90868, CVE-2026-90865 +12 more https://t.co/hNhnltPJV4
@pwnwatch_app
29 Oct 2026
74 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes