CriticalVulnerabilityCVE-2026-90866updated 29 Oct 2026, 16:20 UTC

WS_FTP Server file transfer flaw lets admins escape their folder limits

A bug in WS_FTP Server, a file transfer program, lets a limited admin reach parts of the server they should not see. In the worst case, this could let someone run their own code on the server.

Fix availableOfficial source

Severity	CriticalCVSS 9.1 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes2024.0.7 and 2025.0.4 (versions from these releases onward) · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

How the attack works simplified

1Delegated admin logs inAccount has limited Host Administrator scope
2Path traversal requestCrafted path escapes authorized folder
3Files outside scope reachedAccess granted beyond assigned limits
4Code execution possibleAttack may run code on the server
ResultAttacker may take control of the server

What happened

A path traversal vulnerability in Progress Software WS_FTP Server on Windows allows a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.

Why it is dangerous: Successful exploitation could give an attacker control over the server and the files it stores, affecting everyone who uses it. The risk is highest for organizations that delegate Host Administrator rights to other users.

Are you affected?

You are affected if you run WS_FTP Server on Windows in a version prior to 2024.0.7 or 2025.0.4 and have delegated Host Administrator accounts.

WS_FTP Server on Windows, versions prior to 2024.0.7 and prior to 2025.0.4

What to do

Update WS_FTP Server to 2024.0.7 or 2025.0.4 or later
Review which accounts hold delegated Host Administrator rights and remove any that are not needed
Check server and access logs for unusual file access outside expected folders

Timeline

29 Oct 2026, 16:20 UTC
Publicly disclosed
29 Oct 2026, 16:20 UTC
Reported by NVD · NVD
29 Oct 2026, 16:20 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

CVE-2026-90866NVD · 29 Oct 2026, 16:20 UTC

Technical details

ID: CVE-2026-90866
CVSS: 9.1 / 10
Disclosed: 29 Oct 2026, 16:20 UTC
On Zero Radar: 29 Oct 2026, 16:20 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 16:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works