CVE-2026-90868

Summary

An OS command injection flaw in Progress WS_FTP Server allows authenticated users to execute arbitrary commands on the host when specific configurations are enabled, leading to full system compromise.

Exploitability

Exploitation requires valid low-privilege credentials and a vulnerable configuration; no public exploit is available, but the vulnerability is straightforward to trigger once conditions are met.

Blast radius

Successful exploitation grants attackers full control of the affected server, enabling data theft, lateral movement, and infrastructure disruption across connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WS_FTP Server version 2024.0.7 or 2025.0.4 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.