CVE-2026-908649.1Critical
Host Administrator Path Containment Bypass in Progress WS_FTP Server
Progress Software · WS_FTP Server
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.1CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 30 Oct.
- Progress patches 15 WS_FTP Server flaws, including CVE-2026-84295SecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.