WS_FTP Server CVE-2026-90872

Exploitation requires an authenticated Manager administrator account on the WS_FTP Server Manager web console - the attacker must already hold the application's highest administrative privilege (PR:H), so this is not reachable by anonymous or low-privileged remote users. The target must be a Windows deployment running the WS_FTP Server IIS worker process, on a version prior to 2024.0.7 (2024 branch) or prior to 2025.0.4 (2025 branch). Code executes only at the privilege level of the IIS worker process, not necessarily SYSTEM/administrator on the host, which limits impact. These factors (admin-only access, Windows/IIS deployment, worker-process privilege ceiling) substantially constrain realistic risk relative to the network attack vector.

This is a moderate-severity, privilege-gated code-injection flaw (CWE-95) whose real-world urgency is tempered by its authentication requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L, base 6.6) shows a network-reachable, low-complexity attack with NO user interaction, but PR:H confirms the attacker must already hold Manager administrator privileges in the WS_FTP Server console - the application's highest trust tier. There is no EPSS score, no CISA KEV listing, and no PoC in the provided data (the only reference is the Progress vendor advisory), so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' which aligns with a real-but-not-emergency priority: patch within the normal monthly cycle rather than as an out-of-band emergency. The dominant mitigating factor is PR:H - this is a privilege-escalation/post-compromise capability (an admin turning console access into OS-level command execution) rather than a pre-auth internet-facing RCE, which is why the score lands at Medium despite being labeled RCE. Note for contrast: Progress WS_FTP previously had a pre-auth critical flaw (CVE-2023-40044) that was mass-exploited; this CVE is a materially lower-risk, admin-only issue and should not be conflated with that class.

An attacker who has already obtained (or abused) WS_FTP Server Manager administrator credentials logs into the Manager web console and submits crafted input to a feature that dynamically evaluates code, injecting OS directives. The injected directives then execute arbitrary commands at the privilege level of the WS_FTP Server IIS worker process on the Windows host. No public exploit code was identified in the available data, and the trigger is not described in detail in the vendor reference beyond 'improper neutralization of directives in dynamically evaluated code.'