WS_FTP Server CVE-2026-90861

Exploitation requires the attacker to already possess an administrator account on a WS_FTP Server instance running on Windows at a version prior to 2024.0.7 or 2025.0.4 (PR:H). Under this condition, that administrator can view another user's password stored/displayed in clear text and reuse those credentials to escalate to broader administrative access. The exploitation LIMITS are significant: it is not remote-unauthenticated - a valid administrative foothold is mandatory - and it is confined to the Windows builds in the affected version ranges; patched builds (2024.0.7, 2025.0.4) remediate it. The advisory does not describe the exact feature or workflow through which the clear-text password becomes visible, so the precise trigger is not described in the available sources.

This is a moderate-severity privilege-boundary issue, not a mass-exploitation emergency. The input CVSS of 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) already encodes the single most important limiter: PR:H means the attacker must ALREADY hold an administrator account on WS_FTP Server before anything can be gained - so this is an administrator-to-higher-privilege escalation / insider-trust problem rather than a remote entry point. Exploitation status is 'no public exploit identified at time of analysis': the input shows no EPSS score, no CISA KEV listing, and no POC/exploit reference, so all three independent exploitation signals are either absent or negative, which is consistent with the vendor's 'this_month' priority (patch on a normal monthly cycle, not act_now/emergency). CONFLICT TO VERIFY: the input vector asserts AC:H, but the available advisory does not describe any trigger mechanism (race, timing, or attacker-uncontrolled precondition) that would justify high attack complexity - a password simply being readable in clear text to a peer administrator reads more like AC:L, so the AC:H rating is unverified from the evidence. The C:H/I:H/A:H ratings are plausible because the harvested credentials are described as granting 'broader administrative access,' which would let the attacker read, alter, and disrupt the server. Net: a real but bounded risk driven almost entirely by the pre-existing-admin prerequisite; prioritize for the normal patch window rather than as a drop-everything event.

An attacker who already holds a limited administrator account on a vulnerable WS_FTP Server views another user's password in clear text through the management interface, then logs in with those harvested credentials to obtain broader administrative control of the server. No public exploit is identified at time of analysis, and the action requires a pre-existing administrator foothold (PR:H).