CVE-2026-90864: falha crítica em Progress Software WS_FTP Server
Host Administrator Path Containment Bypass in Progress WS_FTP Server
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.5%
A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Progress Software · WS_FTP ServerCVEs relacionadas — Progress Software WS_FTP Server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-90868CRITICALOS Command Injection in Progress WS_FTP ServerEPSS 1.5%CVE-2026-90865CRITICALCommand Injection via FTP Notification Variables in Progress WS_FTP ServerEPSS 1.1%CVE-2026-90866CRITICALVirtual Folder Path Confinement Bypass in Progress WS_FTP ServerEPSS 0.7%CVE-2026-90863CRITICALPrivilege Escalation via Missing Authorization in WS_FTP ManagerEPSS 0.7%CVE-2026-84295CRITICALImproper Authentication in Progress WS_FTP ServerEPSS 0.6%CVE-2026-90867HIGHImproper Access Control of Web Admin Console in Progress WS_FTP ServerEPSS 0.4%