CVE-2026-90862 PUBLISHED

Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server

Assigner: ProgressSoftware
Reserved: 14.09.2026 Published: 29.10.2026 Updated: 29.10.2026

Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Progress Software
Product	WS_FTP Server
Versions	Default: unaffected affected from 0 to 2024.0.7 (excl.) affected from 0 to 2025.0.4 (excl.)

Workarounds

Restrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.

Credits

Tanishq Shah (tanishqshah) finder

References

https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view

Problem Types

CWE-287: Improper Authentication CWE
CWE-308: Use of Single-factor Authentication CWE

Impacts

Authentication Abuse - allows file downloads from a pending multi-factor authentication session