External risk intelligence

WS_FTP Server Path Traversal Allows Delegated Administrator Scope Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-90866

WS_FTP Server is a managed file transfer application designed to be internet-facing for external file exchange and remote access. While this specific vulnerability requires delegated administrator access, the product itself is commonly deployed at the network edge to facilitate connectivity, making the management interface and associated services frequently reachable in public-facing deployment scenarios.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a path traversal vulnerability in Progress Software WS_FTP Server. The issue could allow a delegated administrator to access unauthorized areas, potentially leading to the execution of malicious code. Given the nature of WS_FTP Server as a file transfer application often exposed to the internet, confirming the relevance and exposure of this vulnerability is the primary concern.

Delegated admin can access unauthorized areas.
Could allow remote code execution.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with delegated administrator privileges could exploit this vulnerability by navigating through unauthorized directories. This occurs within the WS_FTP Server's administrative interface, where a weakness allows access beyond intended boundaries, potentially leading to the execution of arbitrary code on the server.

Delegated administrator access required.
Path traversal in the administrative interface.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a delegated administrator to access restricted file system locations on the server. When supported by the advisory, this could potentially lead to the execution of unauthorized code, impacting the confidentiality and integrity of the system and its data.

System file access and control.
Delegated admin accesses unauthorized locations.
Potential for unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This path traversal vulnerability in WS_FTP Server requires delegated administrator access but could allow unauthorized system access, potentially leading to remote code execution. The first practical step is to identify all instances of WS_FTP Server, confirm their exposure and business criticality, and then determine the accountable owner for remediation planning.

Ownership: Infrastructure and Application teams.
Verify: Server reachability and administrative access.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress Software WS_FTP Server?

WS_FTP Server is a managed file transfer application built for the Windows operating system. Organizations use it to securely handle, automate, and centralize the exchange of data files between internal systems and external partners. Because it is designed to facilitate connectivity, it often resides at the edge of a network to bridge the gap between private storage and remote users.

What does path traversal mean in the context of CVE-2026-90866?

This vulnerability involves a weakness categorized as CWE-22, where the software fails to properly restrict file system navigation. In this specific case, the flaw allows an authenticated user to 'climb' out of their designated administrative folders. By breaking these boundaries, a user can access system files they are not authorized to see, which may eventually allow them to execute unauthorized code on the server.

Does this vulnerability trigger automatically for any user?

No. This flaw is not accessible to standard users or unauthenticated internet visitors. It specifically requires an attacker to already possess delegated administrator privileges within the WS_FTP Server interface. Simply browsing the site or interacting with general file transfer features without these elevated administrative permissions does not trigger the path traversal path.

Why is this CVE significant for my organization?

Halo Surface Signal indicates that WS_FTP Server is frequently deployed in internet-facing configurations to enable remote file exchange. When an application that manages data transfers is reachable from the public internet, any vulnerability that could lead to unauthorized system access or code execution poses a higher risk to your infrastructure compared to internal-only tools.

How should I respond to this threat advisory?

Start by identifying all instances of WS_FTP Server running within your environment. Once you have a complete inventory, verify the reachability of those servers and confirm who manages them. Your priority is to ensure the accountable infrastructure or application owners are aware of the vulnerability and have begun planning their remediation strategy to protect the server and its data.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.