WS_FTP Server CVE-2026-90867

Exploitation requires network access to the Web Admin console of Progress WS_FTP Server running on Windows at a version prior to 2024.0.7 (2024 branch) or 2025.0.4 (2025 branch); the improper access control (CWE-284) exposes administrative functionality to remote callers without prior authentication (PR:N). A limiting factor is the CVSS high attack complexity (AC:H), which implies a specific precondition must hold for success, but the trigger is not described in the available sources. Hosts already upgraded to 2024.0.7 or 2025.0.4 or later are not affected.

This is a moderately high-priority issue whose real-world urgency sits below what the 8.1 base score alone suggests. The CVSS vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw (PR:N) with high attack complexity (AC:H), and the vuln.today decision label is 'this_week' rather than act_now/emergency. No CISA KEV listing is present, so exploitation is NOT confirmed active; no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified; and no POC or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The AC:H metric indicates a non-trivial condition must be met to succeed, but the available evidence does not state what that condition is, so the practical difficulty cannot be characterized further. The C:H/I:H/A:H impacts combined with PR:N make this worth prioritizing for patching this week, but the absence of KEV, EPSS, and any PoC signal argues against treating it as an emergency. Note a tension to verify with the vendor: the description frames the flaw as exposing 'administrative functionality to remote authentication attempts,' which reads as an exposure of the auth/admin surface rather than guaranteed full compromise, yet the supplied impact metrics are all High - confirm the true impact against the Progress advisory.

A remote attacker with network reach to the WS_FTP Server Web Admin console on an unpatched Windows host (versions before 2024.0.7 or 2025.0.4) leverages the improper access control to reach administrative functionality that should not be exposed to unauthenticated callers. Because AC:H applies, success depends on a specific condition that the available sources do not describe. No public exploit code is identified at time of analysis.