WS_FTP Server CVE-2026-90865

Exploitation requires the WS_FTP Server (Windows) to be running in a specific vulnerable configuration - the description states the flaw is reachable only 'under certain configurations' and the vendor does not name the exact feature, setting, or deployment mode in the available sources, so the precise prerequisite is not described in the available sources and should be confirmed with the Progress advisory. Limiting factors that reduce real-world exposure: the CVSS vector carries AC:H, indicating the attack is not trivially reliable and depends on conditions beyond the attacker's direct control; the server must be network-reachable; and only versions prior to 2024.0.7 and 2025.0.4 are affected. The vector lists PR:N and UI:N, so no authentication or user interaction is indicated once the vulnerable configuration is present.

This is a credible priority rather than an inflated high-CVSS score. The vendor-assigned CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.0) describes an unauthenticated, network-reachable OS command injection that crosses a scope boundary to run OS commands with elevated privileges - a severe outcome. The one tempering signal inside the vector is AC:H, which is consistent with the description's 'under certain configurations' qualifier: exploitation is not against every deployment but depends on a specific (unnamed) configuration state. The vuln.today decision label is act_now, which should drive urgency. However, several independent corroborating signals are MISSING: no EPSS score is provided, so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation; and no proof-of-concept or exploit reference is supplied. These absences conflict somewhat with an act_now label, suggesting the priority is driven by raw severity, unauthenticated reach, vendor patch availability, and WS_FTP Server's history as a mass-exploitation target rather than by observed in-the-wild activity. Note also an apparent tension to verify with the vendor: the vector states PR:N (unauthenticated) while the description stresses 'under certain configurations' - the configuration dependency is captured as AC:H, not as a privilege requirement, so unauthenticated triggering is plausible but worth confirming against the vendor advisory.

A remote attacker reaches a network-exposed WS_FTP Server running on Windows in the specific vulnerable configuration and submits crafted input that is passed unsafely to an OS command, causing arbitrary commands to execute with elevated privileges on the host. Because the CVSS vector is PR:N, no authentication is indicated, but AC:H and the 'under certain configurations' wording mean reliable triggering depends on the server being deployed in the affected mode. No public exploit or PoC reference was provided in the source data.