CVE-2026-90868criticalCWE-78CWE-88

CVE-2026-90868: falha crítica em Progress Software WS_FTP Server

OS Command Injection in Progress WS_FTP Server

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WS FTP Server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 1.5%
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Progress Software · WS_FTP Server
CVEs relacionadas — Progress Software WS_FTP Server

No mesmo produto, das mais perigosas para as menos.

CVE-2026-90865CRITICALCommand Injection via FTP Notification Variables in Progress WS_FTP ServerEPSS 1.1%CVE-2026-90866CRITICALVirtual Folder Path Confinement Bypass in Progress WS_FTP ServerEPSS 0.7%CVE-2026-90863CRITICALPrivilege Escalation via Missing Authorization in WS_FTP ManagerEPSS 0.7%CVE-2026-84295CRITICALImproper Authentication in Progress WS_FTP ServerEPSS 0.6%CVE-2026-90864CRITICALHost Administrator Path Containment Bypass in Progress WS_FTP ServerEPSS 0.5%CVE-2026-90867HIGHImproper Access Control of Web Admin Console in Progress WS_FTP ServerEPSS 0.4%