CVE-2026-90872

DiscoveredOct 29, 2026UpdatedOct 30, 2026

Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an authenticated Manager administrator to execute arbitrary commands with the privileges of the WS_FTP Server IIS worker process.

View graph Watch Export

CVSS v3.1

6.6 MEDIUM

EPSS

—%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

ScopeCHANGED

ConfidentialityLOW

IntegrityLOW

AvailabilityLOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Connections

2 relationships

Timeline

disclosure → media coverage

Oct 29, 2026

Disclosure — published as a CVE record.