The vulnerability is a missing authorization check in the administrative interface of Progress Software WS_FTP Server on Windows. A delegated Host Administrator can act beyond the limits of their assigned permissions, potentially executing arbitrary commands with elevated privileges. This escalation can lead to full compromise of the underlying server, exposing confidential data and allowing attackers to take control of the system.

The affected product is Progress Software WS_FTP Server. Versions prior to 2024.0.7 and 2025.0.4 on Windows are impacted. Users running these configurations should confirm their server version and operating system.

The CVSS score of 9.1 indicates a critical severity. While an EPSS score is not available, the high CVSS rating suggests that if the vulnerability is known to exploit, it would pose a significant risk. The vulnerability is not listed in CISA KEV, but the potential for arbitrary command execution makes it a high-value target for attackers. Inferred further, the attack vector likely requires access to the administrative interface, meaning either privileged local access or a compromised internal account with Host Administrator rights.