WS_FTP Server 授權缺失導致特權提升漏洞（CVE-2026-90863）
CVE-2026-90863 - Privilege Escalation via Missing Authorization in WS_FTP Manager
WS_FTP Server 於 2026 年發現一個授權缺失漏洞，攻擊者可在 Windows 環境中提升許可權並執行任意指令，進而完全佔領伺服器。
- \n- 受影響版本：2024.0.7 以前與 2025.0.4 以前\n- 安全建議：升級至 2024.0.7 或 2025.0.4。
- 限制管理介面存取。
此 CVE 造成 WS_FTP Server 授權缺失，易被提升許可權執行任意指令，提醒升級至 2024.0.7 2025.0.4 以防止系統被佔領。
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Impact
Affected Products
The following products are affected by CVE-2026-90863
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Progress | ws_ftp_server |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | f9fea0b6-671e-4eea-8fde-31911902ae05 | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Update WS_FTP Server to a patched version to fix authorization flaws and prevent unauthorized command execution.
- Update WS_FTP Server to version 2024.0.7 or later.
- Update WS_FTP Server to version 2025.0.4 or later.
- Apply vendor-provided security patches immediately.
- Restrict administrative access to authorized personnel.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90863 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.