CVE-2026-90868: OS Command Injection in Progress WS_FTP

Critical vulnerability (CVSS 9.9) in WS_FTP Server: remote OS command injection. Update to 2024.0.7 or 2025.0.4.

CVE-2026-90868 is an OS command injection vulnerability affecting Progress Software WS_FTP Server in versions prior to 2024.0.7 (2024 branch) and 2025.0.4 (2025 branch) on Windows systems. The flaw allows arbitrary command execution under specific configurations, representing a critical risk for organizations relying on this software for secure file transfer operations.

The vulnerability carries a CVSS score of 9.9 and is classified as critical. Published on NVD on October 29, 2026, it has been reported on social media platforms today with discussions emphasizing the need for immediate patching. No verified public exploits are currently known, but the severity and information dissemination speed require immediate attention from security teams.

IT leaders and CISOs should: verify WS_FTP Server versions in production; immediately apply the update to 2024.0.7 or 2025.0.4; restrict access to the affected component until patching is complete; monitor logs for exploitation attempts. Patching is the only verified mitigation available.

At a glance

What: OS command injection in Progress WS_FTP Server on Windows systems
Severity: CVSS 9.9 (Critical)
Affected versions: WS_FTP Server < 2024.0.7 and < 2025.0.4
Fix: Update to 2024.0.7 or 2025.0.4
Status: Published October 29, 2026. No verified public exploit known at this time.
Action: Verify versions in production, patch immediately, restrict access until patching completes, monitor logs.

Sources: NVD, CVE-2026-90868

← All articles