{"id":"CVE-2026-90863","published":"2026-10-29T16:20:04.337","lastModified":"2026-10-30T04:18:28.807","description":"Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-862","CWE-915"],"vendors":[],"products":[],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A delegated Host Administrator in Progress WS_FTP Server (pre-2024.0.7 and pre-2025.0.4) lacks proper authorization checks in the admin interface, allowing them to escalate privileges and execute arbitrary commands with full server compromise.","exploitability":"Exploitation requires valid credentials for a delegated Host Administrator role and access to the vulnerable administrative interface; no public exploit exists.","blast_radius":"Successful exploitation grants full control of the underlying Windows server, enabling data theft, lateral movement, and persistent backdoor deployment.","remediation":"Upgrade to WS_FTP Server version 2024.0.7 or 2025.0.4 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","rce","admin-interface","missing-authz"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:19:20.812Z"}}