CVE-2026-90861 PUBLISHED

Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

Assigner: ProgressSoftware
Reserved: 14.09.2026 Published: 29.10.2026 Updated: 29.10.2026

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 6.6

Product Status

Vendor Progress Software
Product WS_FTP Server
Versions Default: unaffected
  • affected from 0 to 2024.0.7 (excl.)
  • affected from 0 to 2025.0.4 (excl.)

Workarounds

Restrict access to administrative logs to trusted personnel. Avoid changing privileged account passwords through FTP until the fix is applied. Contact Progress Software Technical Support for guidance on available mitigations.

Credits

  • Niv Levy (restricted) finder

References

Problem Types

  • CWE-532: Insertion of Sensitive Information into Log File CWE
  • CWE-522: Insufficiently Protected Credentials CWE

Impacts

  • Collect Data from Common Resource Locations - sensitive password-change arguments are stored in logs and disclosed to a lower-privileged delegated administrator