External risk intelligence

WS_FTP Server Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-90865

WS_FTP Server is a managed file transfer solution designed to be public-facing to facilitate external file exchanges and remote connectivity. As an internet-exposed gateway service used for data transfer, it is frequently deployed at the network edge, making its attack surface highly reachable from the public internet by design.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical vulnerability in Progress Software WS_FTP Server that could permit unauthorized command execution with elevated privileges if specific configurations are in place. This type of vulnerability can significantly compromise system security and data integrity.

Enables unauthorized command execution on servers.
Matters for protecting sensitive file transfer operations.
Confirm relevance and exposure for your WS_FTP Server.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input over the network to a WS_FTP Server. If the server is configured in a specific way that allows this input to be interpreted as an operating system command, the attacker could potentially execute arbitrary commands with elevated privileges. This could lead to a complete compromise of the affected system.

Entry condition: Network exposure.
Trigger point: Specially crafted server input.
Resulting risk: Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary operating system commands with elevated privileges on affected Windows systems. This is possible when specific configurations are in place, potentially impacting the integrity and availability of the server and its hosted data.

Server command execution.
Unauthenticated remote exploitation.
System compromise and data loss.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for Progress Software WS_FTP Server, likely including application owners, infrastructure, and network/security teams, must first identify all deployments. Confirming reachability and business criticality will inform the prioritization of remediation efforts. The first practical step is to confirm where the affected software is deployed, assess its exposure, and identify the accountable owner to plan a targeted response.

Application and infrastructure owners
Verify server reachability and criticality
Plan risk-based remediation actions

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress Software WS_FTP Server?

WS_FTP Server is a managed file transfer application designed to facilitate secure data exchange, often serving as an internet-facing gateway. It allows organizations to host, share, and manage large volumes of files across networks, acting as a critical point of connectivity for external partners and internal teams.

What does OS command injection mean for CVE-2026-90865?

This vulnerability, classified as CWE-78 and CWE-88, occurs when software improperly processes input, allowing an attacker to insert their own operating system commands. In this specific case, it means an attacker could trick the server into running malicious instructions with high-level system privileges instead of just processing intended file transfer tasks.

How is the command injection triggered?

An attacker triggers this by sending specially crafted input over the network to the server. The bug only occurs if the system is running specific configurations that allow this input to be misinterpreted as an OS command. Standard file transfers that do not contain these malicious patterns or occur on properly configured, hardened setups will not trigger the vulnerability.

Is my WS_FTP Server instance at risk?

According to Halo Surface Signal, this software is frequently deployed at the network edge to enable public-facing data exchanges, making it highly reachable from the internet. If your server is internet-exposed, it is a primary candidate for review, as the vulnerability is network-accessible and does not require local or internal access to attempt exploitation.

What is the first step for those running this software?

You should immediately inventory your environment to locate all WS_FTP Server deployments. Once identified, evaluate the network reachability and business criticality of each instance. Coordinate with application and infrastructure owners to understand your specific configuration, which is necessary to determine if you are running the vulnerable versions and to prepare for necessary updates.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.