External risk intelligence

Progress WS_FTP Server Missing Authorization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-90863

The vulnerability affects the administrative interface of a managed file transfer (MFT) server. Such products are commonly deployed as internet-facing gateways or management services to facilitate external data exchange, making the administrative portal a component often exposed to, or accessible from, the network edge in standard operational configurations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Progress Software WS_FTP Server. This issue could allow an administrator with limited privileges to execute unauthorized commands, potentially leading to a full server compromise. The main concern is confirming the relevance and exposure of this technology within our environment.

Unauthorized command execution is possible.
Affects secure file transfer administrative functions.
Assess relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

A delegated administrator, who already has some level of access to the administrative interface, could exploit a flaw in how permissions are checked. This could allow them to perform actions beyond their intended role, leading to the execution of arbitrary commands on the server and full control over it.

Requires delegated administrator access.
Triggers via administrative interface actions.
Leads to command execution and server compromise.

Live Threat

Current exploitation, exposure, and threat context

A missing authorization flaw in the administrative interface of Progress Software WS_FTP Server could allow a delegated Host Administrator to perform actions beyond their intended permissions. When supported by the advisory, this could lead to arbitrary command execution with elevated privileges, potentially compromising the underlying server.

Server data and services.
Delegated administrator access.
Complete server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Technical leaders and security teams should prioritize identifying all instances of Progress Software WS_FTP Server within their environment. The immediate first step involves confirming the system's network exposure, business criticality, and then identifying the accountable owner to plan a risk-based remediation strategy.

Server administrators own this issue.
Verify network exposure and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress WS_FTP Server?

Progress WS_FTP Server is a managed file transfer solution designed for secure data exchange. Organizations use it to facilitate and control the movement of sensitive files between internal systems and external partners. It includes administrative interfaces for managing users, hosts, and transfer configurations, which act as the central control plane for these data movement operations.

What does CVE-2026-90863 mean for security?

This vulnerability is classified as a missing authorization issue (CWE-862). It means the software fails to properly verify if a user has the right to perform a specific action. In the context of this CVE, a user with limited administrative rights can bypass these checks to execute unauthorized commands, effectively gaining the power of a higher-level administrator to compromise the server.

How is this vulnerability triggered?

The flaw is triggered by an attacker who already possesses delegated Host Administrator credentials. The vulnerability resides within the administrative interface. It does not trigger via standard file transfer operations or through general user accounts; it requires an existing authenticated session as a delegated administrator to interact with the specific vulnerable interface functions.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is a likely concern because WS_FTP Server is often deployed as an internet-facing gateway for external data exchange. If your administrative portal is accessible from the network edge, the risk is higher. Even if not directly internet-facing, any system where the management interface is reachable over the network requires evaluation.

How should I respond to this vulnerability?

Start by identifying all instances of WS_FTP Server in your environment. Confirm which servers are accessible via the network and determine their business criticality. Once mapped, identify the designated server owner to coordinate with your security team. Focus on reviewing the version numbers against the advisory to prioritize patching for affected systems.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.