Detections
Analytics

Progress WS_FTP Server < 9.0.7 / 10.0.x < 10.0.4 Multiple Vulnerabilities

critical Nessus Plugin ID 377012

Synopsis

An FTP server installed on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Progress WS_FTP Server installed on the remote Windows host is prior to 9.0.7 (2024.0.7), or is 10.0.x prior to 10.0.4 (2025.0.4). It is, therefore, affected by multiple vulnerabilities:

 - An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.
 (CVE-2026-90868)

 - Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server. (CVE-2026-90863)

 - A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope. (CVE-2026-90864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to WS_FTP Server version 2024.0.7 (9.0.7) / 2025.0.4 (10.0.4) or later.

See Also

http://www.nessus.org/u?cc71c424

Plugin Details

Severity: Critical

ID: 377012

File Name: ws_ftp_server_2024_0_7_2025_0_4.nasl

Version: 1.2

Type: Local

Agent: windows

Family: FTP

Published: 11/6/2026

Updated: 11/6/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 92.86

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-90868

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:progress:ws_ftp_server

Required KB Items: installed_sw/Progress WS_FTP Server, SMB/Registry/Enumerated

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 10/29/2026

Reference Information

CVE: CVE-2026-90861, CVE-2026-90862, CVE-2026-90863, CVE-2026-90864, CVE-2026-90865, CVE-2026-90866, CVE-2026-90867, CVE-2026-90868, CVE-2026-90869, CVE-2026-90870, CVE-2026-90871, CVE-2026-90872

IAVA: 2026-A-1241