Progress WS_FTP Server CVE-2026-90864 主機管理員越權存取漏洞
CVE-2026-90864 - Host Administrator Path Containment Bypass in Progress WS_FTP Server
Progress WS_FTP Server 2024.0.7 以前及 2025.0.4 以前的 Windows 版本存在路徑穿越漏洞，允許授權的主機管理員存取或修改未授權範圍內的檔案。
此漏洞允許授權的主機管理員越權存取或修改不屬於其範圍的檔案，對企業資料安全構成嚴重風險，建議即時升級至 2024.0.7 或 2025.0.4 以消除風險。
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
Impact
Affected Products
The following products are affected by CVE-2026-90864
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Progress | ws_ftp_server |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | f9fea0b6-671e-4eea-8fde-31911902ae05 | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Update WS_FTP Server to patch path traversal vulnerability. Apply version 2024.0.7 or 2025.0.4.
- Update WS_FTP Server to 2024.0.7 or later.
- Update WS_FTP Server to 2025.0.4 or later.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90864 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.