CVE-2026-90865
9 CRITICALPublished 2026-10-29 · Updated 2026-10-30
AI risk analysis
- Summary
- An OS command injection flaw in Progress WS_FTP Server allows unauthenticated attackers to execute arbitrary commands with elevated privileges when specific server configurations are in place, enabling full system compromise.
- Exploitability
- Exploitation requires specific server configurations and high-privilege context; network access alone is insufficient without those conditions.
- Blast radius
- Successful exploitation grants elevated command execution, risking full host takeover, data exfiltration, lateral movement, and service disruption across connected systems.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to WS_FTP Server version 2024.0.7 or 2025.0.4 immediately.
os-command-injectionprivilege-escalationftp-serverwindowscritical
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78, CWE-88
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-90868
- HIGHCVE-2026-105791PoC
- HIGHCVE-2026-106931
- CRITICALCVE-2026-107780PoC
- HIGHCVE-2026-110646PoC
- HIGHCVE-2026-112351
- CRITICALCVE-2026-118477
- CRITICALCVE-2026-67074
Related by shared AI tags and CWE weakness class. Browse the full archive.