{"id":"CVE-2026-90865","published":"2026-10-29T16:20:04.570","lastModified":"2026-10-30T04:18:29.047","description":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78","CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An OS command injection flaw in Progress WS_FTP Server allows unauthenticated attackers to execute arbitrary commands with elevated privileges when specific server configurations are in place, enabling full system compromise.","exploitability":"Exploitation requires specific server configurations and high-privilege context; network access alone is insufficient without those conditions.","blast_radius":"Successful exploitation grants elevated command execution, risking full host takeover, data exfiltration, lateral movement, and service disruption across connected systems.","remediation":"Upgrade to WS_FTP Server version 2024.0.7 or 2025.0.4 immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","privilege-escalation","ftp-server","windows","critical"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:21:25.113Z"}}