CVE-2026-90862
Awaiting Analysis
Awaiting Analysis - Queue
Improper Authentication in WS_FTP Server Web Transfer Module
Vulnerability report for CVE-2026-90862, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-29
Last updated on: 2026-10-29
Assigner: Progress Software Corporation
Description
Description
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Progress Software | WS_FTP Server | 0 |
| Progress Software | WS_FTP Server | 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-308 | The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor. |
