{"id":"CVE-2026-90868","published":"2026-10-29T16:20:04.963","lastModified":"2026-10-30T04:18:29.410","description":"An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78","CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An OS command injection flaw in Progress WS_FTP Server allows authenticated users to execute arbitrary commands on the host when specific configurations are enabled, leading to full system compromise.","exploitability":"Exploitation requires valid low-privilege credentials and a vulnerable configuration; no public exploit is available, but the vulnerability is straightforward to trigger once conditions are met.","blast_radius":"Successful exploitation grants attackers full control of the affected server, enabling data theft, lateral movement, and infrastructure disruption across connected systems.","remediation":"Upgrade to WS_FTP Server version 2024.0.7 or 2025.0.4 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","rce","ftp","windows"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:12:04.242Z"}}