WS_FTP Server CVE-2026-90866

Exploitation requires the attacker to already hold a delegated Host Administrator account on WS_FTP Server (a scoped administrative role), so it is not reachable by anonymous or unauthenticated FTP users - this is the primary limiting factor and matches the PR:H metric. The affected deployment is WS_FTP Server on Windows at versions prior to 2024.0.7 (2024 branch) or prior to 2025.0.4 (2025 branch); patched builds remove the condition. The flaw is the server's failure to confine a delegated Host Administrator to their authorized scope when handling path input, allowing traversal to locations outside that scope; the exact crafted-input trigger is not detailed in the available sources. There is no required user interaction (UI:N) and no non-default feature toggle named in the description, but the delegation model itself - i.e., that such a scoped administrator account exists and is assigned - is the practical precondition.

Multiple signals point the same direction but with important caveats. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) describes a network-reachable, low-complexity flaw with a changed scope and full confidentiality/integrity/availability impact - consistent with a path traversal that escapes a delegated administrator's authorized boundary toward potential RCE. The one signal that materially tempers raw severity is PR:H: this is not an unauthenticated internet attack but one requiring an already-provisioned delegated Host Administrator account, so the realistic threat is a malicious or compromised scoped administrator escalating beyond their delegation rather than a mass-exploitable pre-auth bug. The vuln.today Decision label is act_now and the vendor (Progress) both reported and patched it, which argues for genuine priority. However, no EPSS score, no CISA KEV listing, and no public PoC/exploit reference are present in the input, so the act_now urgency rests on vendor/decision-framework judgment and the severity vector, not on observed exploitation or a known weaponized exploit. No SSVC exploitation/automatable/technical-impact fields were supplied, so that framework cannot be independently applied here. Net: a credible high-priority issue for organizations running WS_FTP Server with delegated Host Administrators, but the PR:H prerequisite and absence of exploitation evidence mean it is a privileged-insider / post-compromise escalation risk rather than a confirmed wormable pre-auth emergency - patch promptly per the act_now label.

A delegated Host Administrator - an account intentionally scoped to administer only a specific host - supplies crafted path-traversal input to the WS_FTP Server management or file interface and reaches filesystem locations outside their authorized scope on the Windows server. By writing to or reading from unintended locations, the actor can escalate beyond their delegation and, per the vendor, potentially achieve remote code execution. No public exploit identified at time of analysis, so this scenario is derived from the vendor description and the AV:N/AC:L/PR:H CVSS vector rather than from observed exploit code.