CVE-2026-90872: falha de média gravidade em Progress Software WS_FTP Server
Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.6epss 0.3%
Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Produtos afetados
Progress Software · WS_FTP ServerCVEs relacionadas — Progress Software WS_FTP Server
No mesmo produto, das mais perigosas para as menos.
CVE-2026-90868CRITICALOS Command Injection in Progress WS_FTP ServerEPSS 1.5%CVE-2026-90865CRITICALCommand Injection via FTP Notification Variables in Progress WS_FTP ServerEPSS 1.1%CVE-2026-90866CRITICALVirtual Folder Path Confinement Bypass in Progress WS_FTP ServerEPSS 0.7%CVE-2026-90863CRITICALPrivilege Escalation via Missing Authorization in WS_FTP ManagerEPSS 0.7%CVE-2026-84295CRITICALImproper Authentication in Progress WS_FTP ServerEPSS 0.6%CVE-2026-90864CRITICALHost Administrator Path Containment Bypass in Progress WS_FTP ServerEPSS 0.5%