{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90862", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-09-14T06:09:55.847Z", "datePublished": "2026-10-29T15:48:42.885Z", "dateUpdated": "2026-10-30T17:14:03.885Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-10-29T15:48:42.885Z"}, "title": "Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "type": "CWE"}, {"lang": "en", "cweId": "CWE-308", "description": "CWE-308: Use of Single-factor Authentication", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Authentication Abuse - allows file downloads from a pending multi-factor authentication session"}]}], "affected": [{"vendor": "Progress Software", "product": "WS_FTP Server", "platforms": ["Windows"], "versions": [{"status": "affected", "version": "0", "lessThan": "2024.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "2025.0.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements."}]}], "references": [{"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}}], "workarounds": [{"lang": "en", "value": "Restrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div>Restrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.</div>"}]}], "credits": [{"lang": "en", "value": "Tanishq Shah (tanishqshah)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T17:13:52.462395Z", "id": "CVE-2026-90862", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T17:14:03.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Tanishq Shah (tanishqshah)"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Authentication Abuse - allows file downloads from a pending multi-factor authentication session"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "WS_FTP Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2024.0.7", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "2025.0.4", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Restrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.", "supportingMedia": [{"type": "text/html", "value": "<div>Restrict Web Transfer Module access to trusted networks and users, and disable Web Transfer functionality if it is not required. Contact Progress Software Technical Support for guidance on available mitigations.</div>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements.", "supportingMedia": [{"type": "text/html", "value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}, {"lang": "en", "type": "CWE", "cweId": "CWE-308", "description": "CWE-308: Use of Single-factor Authentication"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-10-29T15:48:42.885Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-90862", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T17:13:52.462395Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-30T17:13:59.278Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-90862", "state": "PUBLISHED", "dateUpdated": "2026-10-29T15:48:42.885Z", "dateReserved": "2026-09-14T06:09:55.847Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-10-29T15:48:42.885Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "WS_FTP Server", "vendor": "Progress Software", "versions": [{"lessThan": "2024.0.7", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "2025.0.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@progress.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user\u2019s password to access certain files associated with that account without satisfying multi-factor authentication requirements."}], "id": "CVE-2026-90862", "lastModified": "2026-10-30T18:18:16.713", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90862", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T17:13:52.462395Z", "version": "2.0.3"}}]}, "published": "2026-10-29T16:20:04.220", "references": [{"source": "security@progress.com", "url": "https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-308"}], "source": "security@progress.com", "type": "Secondary"}]}

{}