External risk intelligence

WS_FTP Server Path Traversal Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-90864

WS_FTP Server is an internet-facing file transfer service designed for remote data exchange. While this specific vulnerability requires delegated administrator access, the product itself is commonly deployed as an edge-facing service, making its management interfaces and functionality reachable via the internet in typical configurations.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A path traversal vulnerability has been identified in Progress Software's WS_FTP Server, potentially allowing a delegated administrator to access or modify files beyond their intended permissions. This issue affects versions prior to specific updates on Windows. The main concern is confirming whether this specific product and its configurations are in use within our environment to assess any potential relevance.

Allows delegated admins to access unauthorized files.
Confirms if affected software is in use.
Assess relevance; no immediate business impact known.

Attack Path

How an attacker could exploit the issue

A delegated administrator on the WS_FTP Server could exploit this vulnerability by navigating through directory structures to access or alter files they are not meant to reach. This could lead to unauthorized modification or exposure of sensitive information.

Requires delegated administrator privileges.
Path traversal allows access to unauthorized files.
Risk of unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability could allow a delegated administrator to access or modify files beyond their intended permissions. This exposure is possible when the server is accessible over a network and the administrator's account has been delegated specific hosting privileges.

Access to unauthorized files.
Malicious file modification or deletion.
System compromise through elevated access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The presence of a path traversal vulnerability in WS_FTP Server necessitates immediate action from teams responsible for application security and infrastructure. The first practical step is to identify all deployments of WS_FTP Server, confirm their internet reachability and business criticality, and then determine the accountable system owner to plan remediation based on the assessed risk.

Application owners should investigate.
Verify internet-facing instances.
Plan remediation with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress Software WS_FTP Server?

WS_FTP Server is a managed file transfer solution designed for secure data exchange. Organizations use it on Windows systems to provide centralized control over file movement, allowing administrators to configure user access, manage storage directories, and handle secure transfers between internal and external endpoints.

What does path traversal mean in CVE-2026-90864?

This vulnerability is a path traversal weakness, categorized as CWE-22. It happens when software does not properly filter input used to navigate file systems. Because of this flaw, an authenticated user can provide specifically crafted input to break out of their assigned folder boundaries, granting them unauthorized access to files or directories they should not be able to reach.

How does an attacker trigger this vulnerability?

The bug requires the attacker to already hold delegated Host Administrator privileges within the WS_FTP Server software. It is not triggered by unauthenticated users or standard file transfer accounts. If a user does not have these specific administrative rights, they cannot leverage this path traversal to move outside their authorized file scope.

Is my WS_FTP Server at risk?

Halo Surface Signal indicates that WS_FTP Server is often deployed as an internet-facing service for remote data exchange. While the vulnerability requires existing administrative access, the fact that these management interfaces are frequently reachable over the internet increases the potential impact, as it broadens the environment from which a compromised or malicious administrator could attempt to exploit the flaw.

What steps should I take if I use WS_FTP Server?

Start by identifying all instances of WS_FTP Server within your infrastructure. Confirm which versions are running to see if they fall before the patched releases. Work with your system owners to verify the internet accessibility of these instances, assess their criticality, and prioritize applying the vendor-provided updates to mitigate the path traversal risk.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.