CriticalVulnerabilityCVE-2026-90864updated 29 Oct 2026, 16:20 UTC

WS_FTP Server on Windows lets delegated host admins reach files outside their scope

A limited admin account on the file transfer server could read or change files they were not supposed to touch. The flaw is a path trick that breaks out of the folders the admin is allowed to use.

Fixed in 2024.0.7 and 2025.0.4Official source

Severity	CriticalCVSS 9.1 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes2024.0.7 and 2025.0.4 · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

What happened

A path traversal flaw in Progress WS_FTP Server on Windows lets a delegated Host Administrator access or modify files outside their authorized directory scope.

Why it is dangerous: Files belonging to other hosts or the server itself could be read or altered by a user who should only manage their own area. Organizations that give delegated admin rights to multiple teams or customers are most exposed.

Are you affected?

You are affected if you run WS_FTP Server on Windows in a version prior to 2024.0.7 or 2025.0.4 and use delegated Host Administrator accounts.

Progress WS_FTP Server on Windows, versions prior to 2024.0.7 and prior to 2025.0.4

What to do

Update WS_FTP Server to 2024.0.7 or 2025.0.4 (or later)
Review Host Administrator accounts and remove any that are no longer needed
Check file permissions and logs for access outside each admin's assigned folders

Timeline

29 Oct 2026, 16:20 UTC
Publicly disclosed
29 Oct 2026, 16:20 UTC
Reported by NVD · NVD
29 Oct 2026, 16:20 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

CVE-2026-90864NVD · 29 Oct 2026, 16:20 UTC

Technical details

ID: CVE-2026-90864
CVSS: 9.1 / 10
Disclosed: 29 Oct 2026, 16:20 UTC
On Zero Radar: 29 Oct 2026, 16:20 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 16:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works