{"id":"CVE-2026-90872","aliases":[],"cve":{"records":[{"id":"CVE-2026-90872","source":"ProgressSoftware","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-14T06:10:05.561Z","published":"2026-10-29T15:57:24.826Z","modified":"2026-10-30T17:18:24.148Z"}],"publishers":[{"name":"ProgressSoftware","role":"CNA","organizationId":"f9fea0b6-671e-4eea-8fde-31911902ae05","modified":"2026-10-29T15:57:24.826Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:18:24.148Z"}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":["vendor-advisory"],"source":"ProgressSoftware"}],"weaknesses":[{"id":"CWE-95","description":"CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","source":"ProgressSoftware"},{"id":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","source":"ProgressSoftware"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T03:56:43.363801Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server","titleSource":"ProgressSoftware","descriptionSource":"ProgressSoftware","description":"Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.","score":6.6,"severity":"medium","published":"2026-10-29T15:57:24.826Z","modified":"2026-10-30T17:18:24.148Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Progress Software","name":"WS_FTP Server","platforms":["Windows"],"versions":[{"version":"0","status":"affected","lessThan":"2024.0.7","versionType":"custom"},{"version":"0","status":"affected","lessThan":"2025.0.4","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-90872"}],"remediation":[{"text":"Restrict Manager web console access to trusted administrative hosts and networks. Contact Progress Software Technical Support for guidance on available mitigations.","source":"ProgressSoftware","url":"https://www.cve.org/CVERecord?id=CVE-2026-90872"}],"references":["https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"],"sources":[{"name":"CVE","id":"CVE-2026-90872","modified":"2026-10-30T17:18:24.148Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-90872"}],"assessments":[{"source":"ProgressSoftware","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","score":6.6}],"sourceAffected":[],"observedAt":"2026-10-30T18:55:14.983Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T05:20:32.057Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T04:20:31.255Z","attemptedAt":"2026-10-30T04:20:31.255Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T04:20:31.255Z","attemptedAt":"2026-10-30T04:20:31.255Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T04:20:31.255Z","attemptedAt":"2026-10-30T04:20:31.255Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T04:20:31.255Z","attemptedAt":"2026-10-30T04:20:31.255Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113184","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113184","modified":"Oct 29, 2026, 3:57:24 PM","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","checkedAt":"2026-10-30T04:20:31.255Z"},{"source":"NVD","id":"CVE-2026-90872","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90872","modified":"2026-10-30T04:18:29.550","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","checkedAt":"2026-10-30T04:20:31.255Z"},{"source":"GitHub Advisory Database","id":"GHSA-4f4v-r2rp-777f","url":"https://github.com/advisories/GHSA-4f4v-r2rp-777f","modified":"2026-10-29T18:31:14Z","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","checkedAt":"2026-10-30T04:20:31.255Z"}],"aiSummary":{"text":"Progress WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have a vulnerability that allows an authenticated Manager administrator to execute arbitrary commands. This is due to improper neutralization of directives in dynamically evaluated code. The impact is execution of commands with the privileges of the WS_FTP Server IIS worker process.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:06:52.571Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-90872"}]}}