CVE-2026-908659.0Critical
Command Injection via FTP Notification Variables in Progress WS_FTP Server
Progress Software · WS_FTP Server
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.0CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 30 Oct.
- Progress patches 15 WS_FTP Server flaws, including CVE-2026-84295SecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.