WS_FTP Server EUVD-2026-113025

Exploitation requires an authenticated low-privilege account on WS_FTP Server (PR:L), reachable over the network (AV:N), and the server must be running in one of the 'certain configurations' named by the advisory - the exact feature, protocol option, or setting that enables the injection is not described in the available sources. Limiting factors: this is not exploitable against all default deployments (the configuration dependency is the primary constraint), it affects only Windows installations prior to 2024.0.7 (2024 branch) and 2025.0.4 (2025 branch), and it demands valid authentication rather than anonymous access. These conditions meaningfully narrow realistic exposure below what the 9.9 base score suggests.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change - consistent with OS command injection (CWE-78) where an authenticated FTP-layer actor reaches the underlying Windows OS. The vuln.today decision label is act_now and a vendor patch is already available, both pointing to real urgency. However, the signal set is partly incomplete: there is no EPSS score provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference appears in the input - so exploitation is currently theoretical rather than observed. The description's qualifier 'under certain configurations' tempers the raw 9.9: exploitation likely depends on a specific, non-default deployment state that the advisory does not spell out, so the practical attack surface may be narrower than the base score alone implies. Net: treat as act_now per the decision label and the available patch, while recognizing that EPSS is missing and active exploitation is not confirmed by KEV.

An attacker with a low-privilege authenticated foothold on a network-reachable WS_FTP Server instance that is running in the affected configuration submits input that is passed unsafely to an operating-system command, causing arbitrary commands to run on the Windows host. Because the scope changes, the resulting command execution reaches the underlying OS beyond the FTP application itself. No public exploit code was identified in the available data, so this scenario is inferred from the CVSS vector and CWE-78 rather than a demonstrated PoC.