CriticalVulnerabilityCVE-2026-90868updated 29 Oct 2026, 16:20 UTC

WS_FTP Server on Windows can let attackers run commands

A flaw in this file transfer server could let someone outside your company send commands that the server then runs on its own computer. Under certain settings, that could mean full control of the machine.

Fixed in 2024.0.7 and 2025.0.4 (or later)Official source

Severity	CriticalCVSS 9.9 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes2024.0.7 and 2025.0.4 (or later) · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

What happened

An OS command injection vulnerability in Progress Software WS_FTP Server on Windows allows arbitrary command execution under certain configurations. Versions prior to 2024.0.7 and 2025.0.4 are affected.

Why it is dangerous: An attacker who can run commands on the server could read, change, or delete files it holds, or use it as a foothold into the rest of your network. Organizations that expose WS_FTP Server to outside users are most at risk.

Are you affected?

You are affected if you run WS_FTP Server on Windows at a version before 2024.0.7 (2024 branch) or before 2025.0.4 (2025 branch) and it is configured in a way that makes the flaw reachable.

WS_FTP Server on Windows: versions prior to 2024.0.7 and prior to 2025.0.4

What to do

Update WS_FTP Server to 2024.0.7 or 2025.0.4 (or later) immediately
Check whether the server is reachable from the internet and restrict access if possible
Review server and system logs for unusual commands or unexpected files

Timeline

29 Oct 2026, 16:20 UTC
Publicly disclosed
29 Oct 2026, 16:20 UTC
Reported by NVD · NVD
29 Oct 2026, 16:20 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

CVE-2026-90868NVD · 29 Oct 2026, 16:20 UTC

Technical details

ID: CVE-2026-90868
CVSS: 9.9 / 10
Disclosed: 29 Oct 2026, 16:20 UTC
On Zero Radar: 29 Oct 2026, 16:20 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 16:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works