Command Injection via FTP Notification Variables in Progress WS_FTP Server
Impact
Progress WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have an OS command injection vulnerability, potentially allowing arbitrary command execution with elevated privileges. The vulnerability is related to FTP notification variables. Certain configurations are required to exploit this weakness.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
What to do
Contact Progress Software Technical Support for guidance on available mitigations.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Progress Software · ProgressSoftware
WS_FTP Server
2 ranges
Progress Software · ProgressSoftware
WS_FTP Server
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 2024.0.7
custom versions
0 → before 2025.0.4
custom versions
Other versions: unaffected
Original source description
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-90865View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-90865
Observed 2026-10-30T18:55:03.292Z · upstream updated 2026-10-30T17:18:24.861Z
Prioritization updated
before
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-29T00:00:00+00:00", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "total" } ] } ]after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T03:56:40.340149Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "total" } ] } ] - CVE · CVE-2026-90865
Observed 2026-10-30T04:15:40.126Z · upstream updated 2026-10-30T03:56:39.798Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-29T00:00:00+00:00", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "total" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.