WS_FTP Server EUVD-2026-113020

Requires a valid, authenticated delegated Host Administrator account on WS_FTP Server (PR:H) - this is a legitimate but scope-limited administrative role, not an anonymous or unauthenticated position. The flaw lies in the administrative interface's authorization enforcement, so network reachability of that admin interface is needed (AV:N). Exploitation is limited to Windows deployments of WS_FTP Server at versions prior to 2024.0.7 (2024 branch) and prior to 2025.0.4 (2025 branch); patched builds remove the path. The principal limiting factor is the PR:H precondition: an attacker must already hold or compromise a delegated Host Administrator credential, which excludes external unauthenticated actors. No user interaction is required (UI:N).

This is a genuinely high-priority issue, but its risk profile is that of a privilege-escalation flaw rather than a mass-exploitable perimeter vulnerability. The CVSS 9.1 is driven primarily by scope change (S:C) and full triad impact (C:H/I:H/A:H): a delegated Host Administrator can break out of the WS_FTP application's authorization boundary and reach arbitrary command execution on the underlying Windows server. Crucially, the vector is PR:H - exploitation requires an already-privileged, authenticated delegated Host Administrator account, so this is not a path for anonymous internet attackers despite AV:N. The vuln.today decision label is act_now and the vendor (Progress) issued a patch, both signalling urgency, but this flaw is NOT in CISA KEV and no EPSS score, KEV listing, or PoC/exploit reference was supplied - so there is no confirmation of active or probable near-term exploitation. The contrast matters: the severity reflects impact and scope, while the realistic attacker set is limited to insiders or anyone who has already compromised a scoped admin credential. Treat it as a high priority to patch (consistent with the act_now label and vendor patch availability), but recognize the PR:H precondition meaningfully narrows the threat compared with an unauthenticated RCE.

A user holding a delegated Host Administrator role - intended to manage only a limited scope - authenticates to the WS_FTP Server administrative interface and invokes functionality that lacks a proper authorization check, letting them act beyond their assigned scope. This escalation yields arbitrary command execution with elevated privileges on the underlying Windows host, fully compromising the server. No public exploit was identified in the supplied data; the trigger mechanism beyond 'missing authorization in the administrative interface' is not described in the available sources.