CVE-2026-908669.1Critical
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
Progress Software · WS_FTP Server
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
9.1CriticalCVSS
LowMediumHighCrit.
DescriptionNVD
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 30 Oct.
- Progress patches 15 WS_FTP Server flaws, including CVE-2026-84295SecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.