WS_FTP Server CVE-2026-90864

Requires a valid, authenticated delegated Host Administrator account in WS_FTP Server - a scoped sub-administrator role, not an ordinary file-transfer user and not anonymous access. The attacker must already possess this privileged role (PR:H) and the target must run an affected Windows build: WS_FTP Server prior to 2024.0.7 (2024 branch) or prior to 2025.0.4 (2025 branch). Limiting factors: no unauthenticated path, no exploitation by standard end users, and systems already patched to 2024.0.7 or 2025.0.4 are not affected; the specific syntax/feature used to trigger the traversal is not described in the available sources.

This is a genuine high-priority issue but narrower than the 9.1 score suggests in isolation. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity authorization-boundary escape whose defining constraint is PR:H - exploitation requires an already-authenticated delegated Host Administrator, not an anonymous attacker. The scope change (S:C) is the key multiplier: a sub-administrator confined to one host can reach files outside their authorized scope, i.e. a privilege/tenant-boundary violation within a multi-tenant WS_FTP deployment. The vuln.today Decision label is act_now and the vendor (Progress) reported it with a patch available, so remediation should not be deferred. However, signals conflict on breadth: no EPSS score was provided (cannot quantify exploitation probability), the vulnerability is NOT in CISA KEV, and no public exploit was supplied - so there is no evidence of active or widespread exploitation, and the high CVSS is driven by impact and scope rather than by ease of unauthenticated access. Net: real priority for any org that delegates WS_FTP host administration to semi-trusted operators, but the PR:H precondition meaningfully limits mass, opportunistic exploitation compared with prior unauthenticated WS_FTP flaws.

An attacker who holds (or has compromised) a delegated Host Administrator account in WS_FTP Server submits file operations containing path-traversal sequences, causing the server to resolve paths outside that administrator's authorized host scope and read or modify files belonging to other hosts/tenants. No public proof-of-concept was provided; the low attack complexity (AC:L) means that once the privileged role is held, triggering the flaw is straightforward, but the privileged-role requirement bounds who can attempt it.