The vulnerability is an OS command injection flaw that allows attackers to execute arbitrary commands on Windows systems with elevated privileges. This flaw resides in the handling of FTP notification variables within Progress WS_FTP Server. The weakness is classified under CWE‑78 (OS Command Injection) and CWE‑88 (Command Mismatch). If exploited, an attacker could gain complete control over affected servers, reading, modifying, or deleting data, and potentially pivoting to other network assets.

This issue affects Progress Software WS_FTP Server versions older than 2024.0.7 and 2025.0.4 running on Windows. Only customers using the Windows builds of the server with FTP notification variables enabled are impacted. No other operating systems or versions were reported as vulnerable.

The CVSS score of 9 indicates a high severity with potential for full compromise. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation yet; however, the high CVSS and the nature of OS command injection imply a realistic likelihood of exploitation by determined adversaries. The attack vector is inferred to be remote, through the FTP service, given that the flaw is tied to network‑exposed configuration variables.