Description
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Published: 2026-10-29
Score: 8.1 High
EPSS: n/a
KEV: No
Impact: Improper Access Control leading to unauthorized remote administrative access
Action: Apply Mitigation
AI Analysis

Impact

Improper access control in the Web Admin console of Progress Software WS_FTP Server allows remote authentication attempts to reach administrative functionality. The flaw prevents the required local administrative authentication and lets an attacker interact with the console over a network connection, potentially changing configuration settings and user permissions.

Affected Systems

This vulnerability affects Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 running on Windows. No other platforms or version ranges are mentioned in the advisory.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity. Because no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the exploitation probability is uncertain, but the flaw could be leveraged by any remote actor who can reach the Web Admin console, leading to full administrative control of the server.

Generated by OpenCVE AI on October 29, 2026 at 17:54 UTC.

Remediation

Vendor Workaround

Restrict network-level access to the Web Admin console to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.

OpenCVE Recommended Actions

  • Limit access to the Web Admin console to trusted administrative hosts and networks
  • Consult Progress Software technical support for guidance on additional mitigations
  • Upgrade to Progress WS_FTP Server 2024.0.7 or later, or 2025.0.4 or later, once a patch is available

Generated by OpenCVE AI on October 29, 2026 at 17:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.
Title Improper Access Control of Web Admin Console in Progress WS_FTP Server
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-29T15:53:12.203Z

Reserved: 2026-09-14T06:09:55.847Z

Link: CVE-2026-90867

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-29T16:20:04.827

Modified: 2026-10-29T16:24:53.840

Link: CVE-2026-90867

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T18:00:17Z

Weaknesses