Zero Radar
← feed
CriticalVulnerabilityCVE-2026-90863updated 29 Oct 2026, 16:20 UTC

WS_FTP Server admin flaw lets limited admins exceed their rights

A flaw in the WS_FTP file transfer server lets a limited administrator go beyond the permissions they were given. In the worst case, they could run commands with higher privileges and take over the whole server.

Fix availableOfficial source
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes2024.0.7 and 2025.0.4 (fixed versions for the respective release lines) · since 29 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Delegated adminHolds a limited Host Administrator role
  2. 2Admin interfaceMissing authorization check on requests
  3. 3Scope exceededActions beyond the granted rights run
  4. 4Command executionArbitrary commands run with elevated privileges
  5. ResultAttacker gains full control of the server

What happened

Missing authorization checks in the administrative interface of Progress WS_FTP Server on Windows allow a delegated Host Administrator to act outside their authorized scope, potentially enabling arbitrary command execution with elevated privileges.

Why it is dangerous: A successful abuse could give full control of the underlying Windows server, exposing any files and systems it can reach. The risk is greatest for organizations that delegate Host Administrator roles to users.

Are you affected?

You are affected if you run WS_FTP Server on Windows in a version prior to 2024.0.7 or 2025.0.4 and use delegated Host Administrator accounts.

Progress Software WS_FTP Server on Windows: versions prior to 2024.0.7 and prior to 2025.0.4

What to do

  1. Update WS_FTP Server to 2024.0.7 or 2025.0.4 or later
  2. Review which accounts hold Host Administrator rights and remove any that are not needed
  3. Check server and admin logs for unexpected administrative actions or new commands

Timeline

  1. 29 Oct 2026, 16:20 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:20 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 16:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-90863
CVSS
9.1 / 10
Disclosed
29 Oct 2026, 16:20 UTC
On Zero Radar
29 Oct 2026, 16:20 UTC (0 min after disclosure)
Last change
29 Oct 2026, 16:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WS_FTP Server admin flaw lets limited admins exceed their rights · Zero Radar