---
id: CVE-2026-90861
title: >-
  Password Disclosure via Activity Logs Enabling Administrator Privilege
  Escalation in WS_FTP Server
summary: >-
  Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on
  Windows may expose a user's password in clear text to another administrator,
  who could use it to gain broader administrative access to the server.
severity: medium
cvss: 6.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-532
  - CWE-522
vendor: Progress Software
product: WS_FTP Server
affected:
  - ws_ftp_server < 2024.0.7
  - ws_ftp_server < 2025.0.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-30T03:56:37.996783Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:18:25.273Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-90861'
references:
  - url: >-
      https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view
tags:
  - cve.org
epss: 0.00305
epssPercentile: 0.23374
ingestedAt: '2026-11-05T16:24:31.174Z'
---

## Overview

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to gain broader administrative access to the server.

## Affected

- `ws_ftp_server < 2024.0.7`
- `ws_ftp_server < 2025.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Restrict access to administrative logs to trusted personnel. Avoid changing privileged account passwords through FTP until the fix is applied. Contact Progress Software Technical Support for guidance on available mitigations.