# CVE-2026-90862: Progress Software WS_FTP Server multi-factor authentication bypass

Source: https://junglewise.ai/threats/cve-2026-90862-improper-authentication-in-the-web-transfer-module-of-progress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-90862 · Severity: medium · CVSS 4.3 · Published 2026-10-29

Progress WS_FTP Server is a file transfer application used to securely move files across networks. An authentication flaw in its web transfer module allows attackers with valid user credentials to bypass multi-factor authentication (MFA) and access files without completing the second authentication factor. This could expose sensitive files to unauthorized access even when MFA is configured.

Technologies: [Progress Software WS FTP Server](https://junglewise.ai/threats/technologies/progress-software-ws-ftp-server). Vendors: [Progress Software](https://junglewise.ai/threats/vendors/progress-software).

## Quick answers

**Is CVE-2026-90862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90862 being exploited in the wild.

**How severe is CVE-2026-90862?** Medium severity, with a CVSS score of 4.3, published 29 October 2026.

**Which products and versions are affected?** Progress Software WS FTP Server prior to 2024.0.7 and 2025.0.4.

**Is there a fix for CVE-2026-90862?** Yes: fixed in WS_FTP Server 2024.0.7, 2025.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90862 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-90862?** Check whether you run Progress Software WS FTP Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WS_FTP Server 2024.0.7, 2025.0.4

## Technical details

The Web Transfer Module in WS_FTP Server improperly validates authentication, allowing attackers who possess a user's password to access account files without satisfying MFA requirements. The vulnerability affects versions prior to 2024.0.7 and 2025.0.4 on Windows. A patch is available in the named fixed versions.

## Affected products

- Progress Software WS_FTP Server prior to 2024.0.7 and 2025.0.4

## Timeline

- 2026-10-29: disclosed

## References

- [https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view](https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view)

## Related threats

- [Progress Software WS_FTP Server access restriction bypass in Thin Client Web Transfer](https://junglewise.ai/threats/cve-2026-115341-improper-access-restrictions-in-the-thin-client-web-transfer)
- [Progress Software WS_FTP Server sensitive data exposure in temp file](https://junglewise.ai/threats/cve-2026-115340-progress-software-ws-ftp-server-versions-prior-to-2025-0-5-on)
- [Progress Software WS_FTP Server denial of service via insufficient resource limits](https://junglewise.ai/threats/cve-2026-115339-insufficient-resource-limits-in-progress-software-ws-ftp-server)
- [Progress WS_FTP Server incorrect quota accounting](https://junglewise.ai/threats/cve-2026-115336-incorrect-quota-accounting-in-progress-software-ws-ftp-server)
- [Progress Software WS_FTP Server code injection in Manager web console](https://junglewise.ai/threats/cve-2026-90872-improper-neutralization-of-directives-in-dynamically-evaluated)