{"api_version":"1","generated_at":"2026-10-29T23:21:16+00:00","cve":"CVE-2026-90870","urls":{"html":"https://cve.report/CVE-2026-90870","api":"https://cve.report/api/cve/CVE-2026-90870.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90870","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90870"},"summary":{"title":"Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server","description":"A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.","state":"PUBLISHED","assigner":"ProgressSoftware","published_at":"2026-10-29 16:20:05","updated_at":"2026-10-29 16:24:53"},"problem_types":["CWE-400","CWE-772","CWE-400 CWE-400: Uncontrolled Resource Consumption","CWE-772 CWE-772: Missing Release of Resource after Effective Lifetime"],"metrics":[{"version":"3.1","source":"security@progress.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","name":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view","refsource":"security@progress.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90870","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90870","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Progress Software","product":"WS_FTP Server","version":"affected 2024.0.7 custom","platforms":["Windows"]},{"source":"CNA","vendor":"Progress Software","product":"WS_FTP Server","version":"affected 2025.0.4 custom","platforms":["Windows"]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Niv Levy (restricted)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"WS_FTP Server","vendor":"Progress Software","versions":[{"lessThan":"2024.0.7","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2025.0.4","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Niv Levy (restricted)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation."}],"value":"A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation."}],"impacts":[{"descriptions":[{"lang":"en","value":"Excessive Allocation - repeated unauthenticated requests retain backend sessions and cause resource exhaustion and service degradation"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"},{"cweId":"CWE-772","description":"CWE-772: Missing Release of Resource after Effective Lifetime","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-29T15:55:43.950Z","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware"},"references":[{"tags":["vendor-advisory"],"url":"https://progress.lightning.force.com/lightning/r/Knowledge__kav/ka7Pb000001vl86IAA/view"}],"source":{"discovery":"EXTERNAL"},"title":"Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div>Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations.</div>"}],"value":"Shorten the XFT session timeout where practical, and restrict the Ad Hoc Transfer endpoint to trusted networks if external access is not required. Contact Progress Software Technical Support for guidance on available mitigations."}],"x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","assignerShortName":"ProgressSoftware","cveId":"CVE-2026-90870","datePublished":"2026-10-29T15:55:43.950Z","dateReserved":"2026-09-14T06:09:55.848Z","dateUpdated":"2026-10-29T15:55:43.950Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-29 16:20:05","lastModifiedDate":"2026-10-29 16:24:53","problem_types":["CWE-400","CWE-772","CWE-400 CWE-400: Uncontrolled Resource Consumption","CWE-772 CWE-772: Missing Release of Resource after Effective Lifetime"],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90870","Ordinal":"1","Title":"Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress ","CVE":"CVE-2026-90870","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90870","Ordinal":"1","NoteData":"A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.","Type":"Description","Title":"Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress "}]}}}