Description
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
Published: 2026-10-29
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service via SSH service termination
Action: Patch immediately
AI Analysis

Impact

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows. This flaw allows a denial of service condition that occurs before authentication, effectively rendering the SSH/SFTP service unavailable to legitimate users.

Affected Systems

The affected product is Progress Software WS_FTP Server running on Windows. Versions prior to 2024.0.7 and 2025.0.4 are impacted. No other operating systems or versions are listed as affected.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high severity. No EPSS score is available, and the issue is not listed in CISA KEV. An attacker needs only to possess a valid SSH public key for an existing account; no additional authentication is required. The vulnerability can be exploited remotely over the network, leading to service disruption for all users of the SSH/SFTP interface.

Generated by OpenCVE AI on October 29, 2026 at 17:53 UTC.

Remediation

Vendor Workaround

Restrict network access to the SSH/SFTP service to trusted clients and disable SSH/SFTP access if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.

OpenCVE Recommended Actions

  • Apply the latest security update from Progress Software that addresses the SSH public‑key signature flaw (upgrade to WS_FTP Server 2024.0.7 or 2025.0.4).
  • Restrict network access to the SSH/SFTP service so that only trusted clients can reach it.
  • Disable SSH/SFTP access entirely if the feature is not required.

Generated by OpenCVE AI on October 29, 2026 at 17:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
Title Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
Weaknesses CWE-125
CWE-20
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-29T15:54:48.769Z

Reserved: 2026-09-14T06:09:55.848Z

Link: CVE-2026-90869

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-29T16:20:05.080

Modified: 2026-10-29T16:24:53.840

Link: CVE-2026-90869

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T18:00:17Z

Weaknesses