CVE-2026-908639.1Critical
Privilege Escalation via Missing Authorization in WS_FTP Manager
Progress Software · WS_FTP Server
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.1CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 30 Oct.
- Progress patches 15 WS_FTP Server flaws, including CVE-2026-84295SecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.