Description
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
Published: 2026-10-29
Score: 6.6 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution via Manager web console
Action: Apply Workaround
AI Analysis

Impact

The vulnerability is an improper neutralization of directives in dynamically evaluated code on the Manager web console of Progress Software WS_FTP Server. An authenticated Manager administrator can exploit this flaw to execute arbitrary system commands with the privileges of the IIS worker process, thereby compromising the server’s integrity and confidentiality.

Affected Systems

The vulnerability affects Windows installations of WS_FTP Server prior to version 2024.0.7 and prior to version 2025.0.4. Any system running those releases and exposing the Manager web console is potentially impacted.

Risk and Exploitability

The CVSS score of 6.6 indicates a medium severity level. The EPSS score is not available, so the current likelihood of exploitation remains uncertain. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated Manager administrator who can submit payloads through the console’s input mechanisms, allowing arbitrary command execution as the IIS worker process.

Generated by OpenCVE AI on October 29, 2026 at 17:52 UTC.

Remediation

Vendor Workaround

Restrict Manager web console access to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.

OpenCVE Recommended Actions

  • Restrict Manager web console access to trusted administrative hosts and networks, as recommended by the vendor.
  • In addition, enforce network segmentation or firewall rules to limit exposure of the web console to only approved management networks.
  • Apply least‑privilege principles to Manager accounts and monitor for anomalous command‑execution activity in logs.

Generated by OpenCVE AI on October 29, 2026 at 17:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
Title Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
Weaknesses CWE-94
CWE-95
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-29T15:57:24.826Z

Reserved: 2026-09-14T06:10:05.561Z

Link: CVE-2026-90872

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-29T16:20:05.417

Modified: 2026-10-29T16:24:53.840

Link: CVE-2026-90872

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T18:00:17Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

  • CWE-95

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')