External risk intelligence

WS_FTP Server Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-90868

Progress Software WS_FTP Server is a managed file transfer solution designed to facilitate the movement of files over the internet. These services are commonly deployed as internet-facing gateways or edge services to allow external partners or users to upload and download files, making them frequently exposed to the public internet in standard deployment configurations.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An OS command injection vulnerability has been identified in Progress Software WS_FTP Server. This could allow unauthorized command execution, potentially impacting systems that handle file transfers. The main concern is confirming if our environment utilizes this technology and is exposed to this risk.

Allows unauthorized commands to run.
Affects file transfer systems.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low-privilege access to Progress Software WS_FTP Server could exploit this vulnerability by sending specially crafted requests. This could lead to the execution of arbitrary operating system commands on the server, allowing the attacker to take control of the system.

Requires low-privilege access.
Exploited via crafted requests to the server.
Arbitrary command execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands on a server running Progress Software WS_FTP Server when certain configurations are in place. This could affect the integrity and availability of the server, and potentially allow unauthorized access to system resources or data.

Server system commands.
Network access with limited privileges.
Unauthorized command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical OS command injection vulnerability in Progress Software WS_FTP Server requires immediate attention from teams managing the application and its underlying infrastructure. The first practical step is to identify all instances of the affected software, determine their exposure and business criticality, and locate the accountable system owner. Subsequently, a risk-based remediation plan can be developed, which may involve coordination with Progress Software or implementing temporary security measures.

Application and Infrastructure teams own remediation.
Verify external reachability and business criticality.
Plan and execute necessary security updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress Software WS_FTP Server?

WS_FTP Server is a managed file transfer solution. Organizations use it as a central gateway to securely exchange, upload, and download files with external partners or internal users. Because it handles data movement, it is often deployed at the network edge to facilitate connectivity.

What does OS command injection mean for CVE-2026-90868?

This vulnerability falls under the weakness class of OS Command Injection (CWE-78/CWE-88). It means the software does not properly sanitize user-supplied input, allowing an attacker to inject and execute their own operating system commands directly on the server host, potentially granting them unauthorized control.

How is the command injection triggered?

An attacker must have at least low-privilege access to the server and send specially crafted requests to initiate the exploit. Simply visiting the login page or sending standard, non-malicious file transfer traffic does not trigger the vulnerability; the requests must be intentionally formatted to exploit the command injection flaw.

Why should I care if my WS_FTP Server is internet-facing?

Halo Surface Signal identifies that WS_FTP Server is typically deployed as an edge service exposed to the public internet for file exchanges. Since this vulnerability is network-exploitable, internet-facing instances are at higher risk because they are directly reachable by unauthorized remote actors.

What should I do first to address CVE-2026-90868?

Your first step is to perform an inventory of your environment to locate all instances of Progress Software WS_FTP Server. Once identified, confirm the specific version in use, determine the business criticality of those systems, and coordinate with your infrastructure team to plan and implement the necessary updates provided by the vendor.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.