---
id: CVE-2026-90870
title: Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
summary: >-
  A missing release of backend receiver sessions in the Ad Hoc Transfer
  component of Progress Software WS_FTP Server versions prior to 2024.0.7 and
  2025.0.4 on Windows could lead to server resource exhaustion and service
  degradation.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-772
vendor: Progress Software
product: WS_FTP Server
affected:
  - ws_ftp_server < 2024.0.7
  - ws_ftp_server < 2025.0.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-30T17:14:52.709323Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:15:05.940Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-90870'
references:
  - url: >-
      https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view
tags:
  - cve.org
epss: 0.0027
epssPercentile: 0.19325
ingestedAt: '2026-11-05T16:24:31.147Z'
---

## Overview

A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.

## Affected

- `ws_ftp_server < 2024.0.7`
- `ws_ftp_server < 2025.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.