CVE-2026-90864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90864", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-09-14T06:09:55.847Z", "datePublished": "2026-10-29T15:50:29.084Z", "dateUpdated": "2026-10-30T17:18:24.999Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-10-29T15:50:29.084Z"}, "title": "Host Administrator Path Containment Bypass in Progress WS_FTP Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}, {"lang": "en", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Path Traversal - may allow access to or modification of files outside authorized directory boundaries"}]}], "affected": [{"vendor": "Progress Software", "product": "WS_FTP Server", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "2024.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "2025.0.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope."}]}], "references": [{"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "workarounds": [{"lang": "en", "value": "Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.</div>"}]}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-90864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T03:56:39.496575Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:18:24.999Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Host Administrator Path Containment Bypass in Progress WS_FTP Server", "source": {"discovery": "INTERNAL"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Path Traversal - may allow access to or modification of files outside authorized directory boundaries"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "WS_FTP Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2024.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "2025.0.4", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.", "supportingMedia": [{"type": "text/html", "value": "<div>Limit delegated administrative privileges to trusted personnel. Review folder configurations and account permissions to ensure access remains within authorized boundaries. Contact Progress Software Technical Support for guidance on available mitigations.</div>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.", "supportingMedia": [{"type": "text/html", "value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}, {"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-10-29T15:50:29.084Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-90864", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T03:56:39.496575Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-30T17:12:56.019Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-90864", "state": "PUBLISHED", "dateUpdated": "2026-10-29T15:50:29.084Z", "dateReserved": "2026-09-14T06:09:55.847Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-10-29T15:50:29.084Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "WS_FTP Server", "vendor": "Progress Software", "versions": [{"lessThan": "2024.0.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "2025.0.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@progress.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope."}], "id": "CVE-2026-90864", "lastModified": "2026-10-30T18:18:16.967", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90864", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T03:56:39.496575Z", "version": "2.0.3"}}]}, "published": "2026-10-29T16:20:04.453", "references": [{"source": "security@progress.com", "url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-434"}], "source": "security@progress.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2024.0.7)"}}, {"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WS_FTP Server", "source": "cna", "vendor": "Progress Software"}, "product": "ws_ftp_server", "vendor": "progress"}, {"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2024.0.7)"}}, {"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WS_FTP Server", "source": "cna", "vendor": "Progress Software"}, "product": "ws_ftp_server", "vendor": "progress_software"}], "created": "2026-10-29T18:00:17.797070+00:00", "updated": "2026-10-29T21:00:19.777737+00:00", "vendors": ["progress", "progress$PRODUCT$ws_ftp_server", "progress_software", "progress_software$PRODUCT$ws_ftp_server"]}