CVE-2026-90868

🔴 6 critical CVEs in Progress Software WS_FTP Server Worst: credential exposure in file transfer server (CVE-2026-84295) Patch → see advisories https://cve.now/CVE-2026-84295?release=CVE-2026-90868,CVE-2026-90863,CVE-2026-90864,CVE-2026-90866,CVE-2026-90865

🔥 CyberForge CVE of the Day #091 🚨 CVE-2026-84295 / CVE-2026-90868 — Progress WS_FTP Server: credential exposure and conditional command injection Administrator-credential exposure and command injection are an uncomfortable pairing on a file-transfer server. They require separate evidence trails; a possible relationship is not a demonstrated exploit chain. Progress's CNA rates CVE-2026-84295 at CVSS v3.1 10.0 and CVE-2026-90868 at 9.9. The first needs no authentication. The second has Privileges Required: Low and applies under certain configurations whose precise conditions were not resolved in the reviewed public material. ⚠️ Cover both issues with the appropriate fixed service pack, then verify identity risk separately. Updating software does not prove earlier credentials or sessions were revoked. 🎯 The quick hit The first issue: Unauthenticated remote sensitive-information access, including administrative credentials. Exact entry point, credential format and usability remain unknown. The second issue: Conditional OS command/argument injection. The CNA describes shell operators, but not the command-building site, exact low-privilege role or execution account. Preserve PR:L; standalone unauthenticated execution is not established. Who? Owners of WS_FTP Server on Windows, its enabled components and every node. WS_FTP Professional Client and MOVEit are separate products. Start with: Obtain the running product/build, release family and relevant configuration from the owner. For this duo, the fixed floors are 2024.0.7 / 9.0.7 or 2025.0.4 / 10.0.4, matched to the release family and supported upgrade path. The earlier 2024.0.6 / 2025.0.3 thresholds cover only the first issue. Trail: Access/transfer → account/session → configuration → process/effect evidence. Join the same node and UTC interval using verified source identifiers. Escalate when: An owner-denied privileged session, account change or server command execution correlates with unusual access. An affected build requires repair; a username, failed login, ordinary file transfer or HTTP success alone does not establish exploitation. 🔑 Key details — two records, two conclusions: CVE-2026-84295 — Critical 10.0, Progress CNA, CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Weaknesses: CWE-287 Improper Authentication and CWE-522 Insufficiently Protected Credentials. Network access, Low complexity, no privileges, no user interaction. Published capability: sensitive-information access including administrative credentials; further compromise is possible, not established on any local server. Affected before 2024.0.6 in the 2024 family and 2025.0.3 in the 2025 family. Those releases correspond to 9.0.6 / 10.0.3 and are dated 3rd September 2026 in Progress's release tables. Finder credit: Luu Tien Thanh (thalu93). CVE-2026-90868 — Critical 9.9, Progress CNA, CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Weaknesses: CWE-78 OS Command Injection and CWE-88 Argument Injection. Network access, Low complexity, Low privileges, no user interaction. The description retains certain configurations; the exact feature, role, request and privilege of execution remain unknown here. Affected before 2024.0.7 in the 2024 family and 2025.0.4 in the 2025 family. Those releases correspond to 9.0.7 / 10.0.4, dated 1 October 2026. Finder credit: Yash Kumar Kumawat (ykk0x). Both vectors use Scope: Changed and high confidentiality, integrity and availability impact. Those metrics do not independently prove SYSTEM execution, domain administration, ransomware, persistence or a completed two-CVE chain. NVD: Both records are Awaiting Analysis, with Secondary security@progress.com scores. These are not separate NIST assessments. No valid CVSS v4.0 score was published in the reviewed records; GHSA's null-vector/0.0 defaults mean unavailable, not zero severity. Do not average the two scores or invent a combined score. CISA KEV: Neither exact ID appears in equal direct/mirror catalogue 2026.10.29, 1,764 entries, released 2026-10-29T19:09:34.4003Z. This dated non-match does not establish safety or absence of attacks. FIRST EPSS: Both successful exact-ID requests returned total: 0, data: []. Probability, percentile and model date are unavailable, not zero for each CVE. No other product's score is substituted. CISA SSVC: CISA Coordinator v2.0.3 records Exploitation:none / Technical Impact:total for both at 2026-10-29T00:00:00+00:00. Automatable:yes for 84295; Automatable:no for 90868. These are separate dated assessments, not guarantees or local findings. Exploitation / PoC: No active campaign or independently verified working public PoC was established in the bounded reviewed evidence. A secondary discovery result claims public exploit availability for 84295; that claim was not independently verified. No exploit code, credential test or target request was run. 🧬 Understand the boundary before joining the dots: For 84295, authentication fails to protect sensitive information including administrative credentials. The CNA identifies no endpoint, file, response field, decryption step or credential representation such as plaintext or hashes. Determine potentially exposed accounts/secrets, authority and evidence of later use. An exposed secret is not proof of accepted authentication. Preserve evidence without publishing values or testing candidate credentials. For 90868, untrusted input crosses a command/argument boundary. The CNA mentions shell operators, not a confirmed binary, notification variable, task, port or payload. Establish the legitimate automation baseline. Why together? Potential administrative-credential exposure could enable further access, but a chain still needs compatible deployment, access path, usable credentials, configuration and successful execution. No primary demonstration linking these exact CVEs was verified. Keep the sequence explicit: potential disclosure → accepted identity/session → applicable configuration and operation → observed command execution → independently confirmed effect. Missing evidence between stages remains a gap. Two vulnerabilities on one server do not by themselves supply those transitions. 📦 Version states, release evidence and support There are three useful states within each release family: • Before 2024.0.6 / 2025.0.3: the CNA thresholds place both issues in scope, subject to the command-injection configuration/access conditions. • At 2024.0.6 / 2025.0.3: the first issue's fixed floor is met; the second issue's floor is not. This is the partial-repair state that a one-CVE ticket can overlook. • At 2024.0.7 / 2025.0.4 or an applicable later repaired release: both floors are met in that family. Verify running build/configuration; an installer or inventory entry alone is insufficient. Raw CNA ranges use custom versions and a 0 sentinel. Keep release family with build; do not compare a fixed 2024 build against a 2025 boundary or declare unlisted older branches unaffected. Patch attribution: The Progress-authored CNA records supply the per-CVE thresholds. Public release notes independently confirm aliases and release dates. The four inspected Fixed Issues pages do not name either CVE or expose these security fixes. A general string-memory repair, dependency update or SSH correction on those pages must not be relabelled as this duo's root-cause fix. Lifecycle: Progress lists 2024 (9.0) Sunset 23rd October 2026, Retired 23rd April 2027. It is now Sunset, not Retired: eligible support continues, but no service packs/hot fixes. A fixed floor does not renew active support. The 2025 (10.0) line is Active in the same table, with Sunset 10th December 2027. Prefer an owner-planned migration to an applicable active release, including the required security service pack and supported Windows/database path. The generic “upgrade to 2025.0” instructions do not make the vulnerable 10.0 base a sufficient duo target. Define exposure from deployment, reachability and configuration history. Release dates and 29th October CVE publication do not establish a server’s exposure or repair interval. 🧭 Six SOC checks for this duo: These proposed checks require verified schemas, permissions, retention and clocks. No detector was deployed; a quiet search cannot clear an unobserved path. C01 — Establish build and separate prerequisites Action / location: Obtain running family/build, node list, listeners/modules, configuration and build history from the owner; join existing network policy and observations. Signal / correlation: Check each CVE independently. Record the partial-repair state 9.0.6/10.0.3 versus 9.0.7/10.0.4; retain no-auth versus PR:L/configuration conditions. Benign causes / limits: Stale inventory, passive nodes or an unactivated installer can mislead. Exact vulnerable endpoint/configuration is unresolved; reachability alone is not exploit-path proof. Escalate: Assign affected reachable or unverified instances to the change owner; incident triage needs suspicious activity or unauthorized effects separately. C02 — Preserve records and prove coverage Action / location: Preserve available Manager/access, transfer/log-server/syslog, Windows process/Security, existing EDR and change evidence through supported collection. Retain originals and provenance. Signal / correlation: Check node and UTC coverage. Progress documents None, Errors Only, Normal and Verbose levels; Normal includes file/folder actions, authentication and SITE commands, while Verbose adds connection/protocol detail. Benign causes / limits: Rotation, permissions, forwarding and clock drift cause gaps. Existing sessions see logging changes after logout/login per guide. Current settings cannot recreate history; Verbose is high-volume. Escalate: Raise evidence loss or gaps overlapping suspicion. Missing data is insufficient telemetry; this review changes no logging or sessions. C03 — Investigate identity use after possible disclosure Action / location: Review applicable authentication, Manager, identity-provider and account/change records. Confirm administrators, integrations and secret ownership without unnecessary secret collection. Signal / correlation: Join server/host, source, account, UTC time and available session/request ID to accepted or denied actions and their effect. Seek owner confirmation. Benign causes / limits: Service accounts, NAT, support and emergency work can explain unusual access. Disclosure endpoint and credential format are unverified; no login does not exclude disclosure. Escalate: Corroborated unauthorized use warrants IR/identity-owner review. Exposure, accepted authentication and action remain separate findings; do not test suspected credentials. C04 — Correlate execution with its actual source Action / location: Review retained Windows process and existing EDR evidence. Establish real service/worker identities, legitimate automation and maintenance before judging ancestry. Signal / correlation: Join host, parent/child process, account and UTC time to access/configuration events and effects. Event 4688 needs process auditing; command-line content needs its separate inclusion policy. Benign causes / limits: Integrations, installers and administrators launch legitimate processes. A shell is a behavioural lead, not a unique IOC. The 90868 configuration/account remain unknown; SYSTEM is not assumed. Escalate: Owner-denied execution or an unexplained service-linked effect warrants IR review. Missing 4688 may reflect coverage, not absence of execution. C05 — Follow file and network effects Action / location: Examine approved transfer/file, storage, network and change records covering the server/window. Establish NAT, encryption, placement and missing directions. Signal / correlation: Match host/server, account/session where available, object, operation, outcome and UTC time to approved partner activity and actual file-state evidence. Benign causes / limits: Bulk transfers, retention, retries, replication and address changes can look unusual. A transfer log does not establish intent or every byte; a process does not prove theft or persistence. Escalate: Corroborated unauthorized access/modification merits response review with owner context. Keep exfiltration, persistence and downstream compromise separately evidenced. C06 — Verify both repairs and identity response Action / location: Follow the applicable Progress upgrade procedure; verify running build and service health per node. Identity/IR owners decide secret, session and integration actions. Signal / correlation: Retain old/new build, family, package/change and activation evidence. Meet both CVE floors; verify rotation/revocation effects and transfer/integration acceptance separately. Benign causes / limits: One repaired failover node or a download is incomplete. Successful login/transfer does not establish eradication. Patch completion does not prove credential revocation or historical session termination. Escalate: Keep unknown instances, unsupported paths and unexplained identity/process changes open. Agree trusted recovery if integrity is uncertain; record gaps and owners. 🔎 Indicators, tools and bounded evidence checks: No CVE-specific malicious IP, domain, file hash, URI, command string or unique IOC set was verified. Ordinary FTP/SFTP operations, SITE commands, a Windows shell or a new source address are context to correlate. Do not turn a product feature or a low-privilege account into an indicator of compromise by itself. Check A — collection metadata: With delegated channel rights, inspect Security log enabled state, count, mode and size using Get-WinEvent ListLog. This reads metadata, not audit policy, and cannot prove historical 4688/command-line coverage. Check B — acquired events: On an approved Windows analysis host, query a stable Security EVTX copy for 4688 within an agreed UTC interval, capped at the newest 200 matches. Keep host, time, record ID and event content; inspect versioned named fields before correlation. At the cap, narrow the interval or arrange a complete review. Retain UTC bounds; displayed TimeCreated may use local time. Errors/missing fields are gaps. Enabling auditing now cannot recreate earlier events; command lines may contain secrets. The full report contains the two illustrative commands, prerequisites and exact parser results. They were documentation-reviewed and PowerShell syntax-parsed only. No Get-WinEvent command, client channel, EVTX query, service request or detector was executed. Syntax acceptance is not Windows runtime or detection validation. 🩹 Repair, exposure reduction and recovery: Choose the correct target: Verify 2024.0.7/9.0.7 or 2025.0.4/10.0.4 in the applicable branch, and plan migration from Sunset 2024 to an active supported release. Obtain current installation, Windows/database, backup, rollback and availability requirements from the product owner and Progress. No installer was downloaded or run here. Progress’s 2025 installer uses PowerShell for registry encryption settings; follow approved installation policy. Failover upgrades from before 10.0.0 require manual registry synchronization for shared-database secret decryption. Follow the full applicable procedure; no policy or secret changes were made here. Temporary controls: Both CNAs direct customers to Progress Technical Support for mitigation guidance. No universal workaround was verified. Owner-reviewed exposure restrictions and integration/access controls are proposed defense in depth, not proof that a guessed module or port blocks either flaw. Identity response: Scope potential exposure, accepted sessions and later use. Coordinate rotation/revocation and verify its effect with identity/integration owners. MFA may add defense in depth; it does not repair either vulnerable code path. Recovery: Corroborated execution or untrusted state needs IR-led containment/recovery and downstream review. Verify restored transfers/integrations. Repaired binaries do not clear old identities or unauthorized state. 🧾 Evidence separation and CyberForge verdict: Source assertions: Progress CNAs establish product, separate conditions/capabilities, scores and thresholds; release tables establish aliases/dates. The lifecycle reader supplies policy/table; raw HTTP was a CSS/loading shell. Dated intelligence: KEV non-matches, missing EPSS rows, different SSVC automation assessments, unreviewed/unmapped GHSAs and OSV404s do not establish safety or missing fixes. Forge analysis: Potential credential exposure and conditional command execution make a sensible combined scoping exercise. The credential-to-execution relationship remains a hypothesis until its transitions and prerequisites are established. No combined severity score, proven chain or local compromise is asserted. 🔥 CyberForge verdict: Close both version gaps, preserve the identity-to-process trail and verify what the update actually changed. Prefer the active supported release path, keep 90868's low-privilege/configuration requirements visible, and handle potential credentials or existing sessions through a separate evidence-based response. A quiet search and an installed service pack cannot clear an unobserved history. Handover: Record node/product/family/build and snapshot time; each CVE's applicability; configuration unknowns; exposure interval; source coverage and gaps; suspicious correlations and benign causes; repair and identity owners; running-build and revocation evidence; recovery/service acceptance. No findings ≠ proof of a clean system. 🔗 Authoritative reading: Progress-authored CVE records: https://www.cve.org/CVERecord?id=CVE-2026-84295 https://www.cve.org/CVERecord?id=CVE-2026-90868 Linked vendor advisory — login required in this review: https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view Release aliases/dates: https://docs.progress.com/bundle/wsftp-server-release-notes-2025/page/Whats-New-in-WS_FTP-Server-2025.html https://docs.progress.com/bundle/wsftp-server-release-notes-2024/page/Whats-New-in-WS_FTP-Server-2024.html Lifecycle: https://community.progress.com/s/products/ws-ftp/product-lifecycle Logging: https://docs.progress.com/bundle/wsftp-server-help-2025/page/Log-Settings.html NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-84295 and https://nvd.nist.gov/vuln/detail/CVE-2026-90868 CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog FIRST EPSS: https://www.first.org/epss/ Event-query documentation: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent #CyberSecurity #CVE #BlueTeam #SOC #ThreatHunting #IncidentResponse #CyberForge #Progress #WSFTP

Patch 15 WS_FTP Server vulnerabilities now, including 10.0 CVSS flaw CVE-2026-84295 and 9.9 CVSS command injection bug CVE-2026-90868. #WSFTPServer #ProgressSoftware #CVE202684295 #Cybersecurity #Vulnerability #InfoSec https://securityonline.info/ws-ftp-server-vulnerabilities-cve-2026-84295/

#NØØT_Security_Alerts 🚨 #ALERT — Critical Command Injection in Progress WS_FTP Server October 29, 2026 PRODUCT: Progress Software WS_FTP Server for Windows. CVE: CVE-2026-90868. SEVERITY: CRITICAL — CVSS 9.9. AFFECTED VERSIONS: Before 2024.0.7 in the 2024 branch and before 2025.0.4 in the 2025 branch. IMPACT: OS command injection may permit arbitrary command execution under certain configurations. ATTACK CONDITIONS: Remote network access and low-privileged authenticated access are required according to Progress’s CVSS vector. User interaction is not required. EXPLOITATION STATUS: Official Progress-authored CVE record published October 29. No independently confirmed exploitation in the wild. FORENSIC TRIAGE: Review administrative and low-privilege account activity, unexpected child processes and unusual server commands. URGENT ACTION: Upgrade to WS_FTP Server 2024.0.7, 2025.0.4 or newer. Minimize exposed administrative interfaces and inspect suspected compromise. SOURCE: https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90868.json CONFIDENCE: HIGH — Original vendor CNA vulnerability record and official release documentation. #WSFTP #CommandInjection #CVE #ServerSecurity #ThreatIntelligence #InfoSec