{"id":"CVE-2026-90867","aliases":[],"cve":{"records":[{"id":"CVE-2026-90867","source":"ProgressSoftware","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-14T06:09:55.847Z","published":"2026-10-29T15:53:12.203Z","modified":"2026-10-30T17:18:24.424Z"}],"publishers":[{"name":"ProgressSoftware","role":"CNA","organizationId":"f9fea0b6-671e-4eea-8fde-31911902ae05","modified":"2026-10-29T15:53:12.203Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:18:24.424Z"}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":["vendor-advisory"],"source":"ProgressSoftware"}],"weaknesses":[{"id":"CWE-284","description":"CWE-284: Improper Access Control","source":"ProgressSoftware"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T03:56:41.868911Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Improper Access Control of Web Admin Console in Progress WS_FTP Server","titleSource":"ProgressSoftware","descriptionSource":"ProgressSoftware","description":"Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.","score":8.1,"severity":"high","published":"2026-10-29T15:53:12.203Z","modified":"2026-10-30T17:18:24.424Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Progress Software","name":"WS_FTP Server","platforms":["Windows"],"versions":[{"version":"0","status":"affected","lessThan":"2024.0.7","versionType":"custom"},{"version":"0","status":"affected","lessThan":"2025.0.4","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-90867"}],"remediation":[{"text":"Restrict network-level access to the Web Admin console to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.","source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-90867"}],"references":["https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"],"sources":[{"name":"CVE","id":"CVE-2026-90867","modified":"2026-10-30T17:18:24.424Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-90867"}],"assessments":[{"source":"ProgressSoftware","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1}],"sourceAffected":[],"observedAt":"2026-10-30T18:55:06.596Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T04:20:33.733Z","attemptedAt":"2026-10-30T04:20:33.733Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T04:20:33.733Z","attemptedAt":"2026-10-30T04:20:33.733Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T04:20:33.292Z","attemptedAt":"2026-10-30T04:20:33.292Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T04:20:34.018Z","attemptedAt":"2026-10-30T04:20:34.018Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113024","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113024","modified":"Oct 29, 2026, 3:53:12 PM","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T04:20:33.292Z"},{"source":"NVD","id":"CVE-2026-90867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90867","modified":"2026-10-30T04:18:29.290","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T04:20:33.733Z"},{"source":"GitHub Advisory Database","id":"GHSA-6fmf-7mqv-8mvj","url":"https://github.com/advisories/GHSA-6fmf-7mqv-8mvj","modified":"2026-10-29T18:31:07Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T04:20:33.733Z"}],"aiSummary":{"text":"Progress WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have improper access control in the Web Admin console, potentially exposing administrative functionality to remote authentication attempts. An attacker would need network access to exploit this weakness. The impact is not fully stated.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:06:45.777Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-90867"}]}}