WS_FTP Server CVE-2026-90869

Exploitation requires the attacker to (1) target a WS_FTP Server instance on Windows running versions prior to 2024.0.7 or 2025.0.4, and (2) know a valid account's enrolled SSH public key - a specific per-account enrollment value that must be discovered or obtained beforehand. The affected component is the shared SSH service, so the required feature is SSH key-based enrollment being in use. Limiting factors: the need to know a valid account's enrolled public key is a concrete prerequisite that constrains opportunistic/spray exploitation (though public keys are not secrets, the specific enrolled key for a valid account is not generally published); impact is confined to service termination (DoS) and does not yield access, code execution, or data exposure.

This is a denial-of-service vulnerability (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in Progress WS_FTP Server's shared SSH service, with CWE-125 (out-of-bounds read) as the root cause. The only impact is availability (A:H); confidentiality and integrity are explicitly N, so despite the 'Information Disclosure' tag in the input there is no data-exposure impact per the vector. The vendor's vector marks PR:N and AC:L, but the description adds a concrete precondition - the attacker must know a valid account's enrolled SSH public key - which is a non-trivial reconnaissance requirement that I believe raises real-world attack complexity above AC:L (see assessed vector). No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no signal of active or imminent exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patch being available and the impact being service disruption rather than code execution or data loss. Net: a legitimate high-severity availability issue worth patching on a near-term (this-week) schedule, but not a drop-everything emergency and not a confidentiality/integrity risk.

A remote attacker who has obtained a valid account's enrolled SSH public key sends a crafted request to the shared SSH service of a WS_FTP Server instance running on Windows, triggering an out-of-bounds read that crashes and terminates the service for all users. Because the SSH service is shared, a single successful request results in an outage affecting every account on that server. No public exploit code or PoC reference was provided in the available data.