CVE-2026-90862
MEDIUM(4.3)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS 4.3 — Mittel
Erwähnungen (letzte 60 Tage)
EPSS-Score
0.2%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
4.3
Technische Schwere
Beschreibung
Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.
Erkennung & Indikatoren
Ausnutzung
In den geprüften Quellen nicht genannt
Behobene Versionen
- 2024.0.7
- 2025.0.4
Threat-Hunting-Queries
Detection for attempts to bypass multi-factor authentication (MFA) for WS_FTP Server Web Transfer Module. This requires logging of authentication attempts and MFA status.
Sentinel/Defender KQL
DeviceLogonEvents
| where InitiatingProcessFileName == "wsftpsvr.exe"
| where ActionType == "LogonAttempt"
| where AdditionalFields contains "MFA_Bypass_Attempt"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, AccountName, AdditionalFieldsSplunk SPL
index=windows_logs sourcetype=ws_ftp_server_logs "MFA_Bypass_Attempt" | table _time, host, user, src_ip, messageSigma
title: WS_FTP Server MFA Bypass Attempt
status: experimental
description: Detects attempts to bypass multi-factor authentication in WS_FTP Server Web Transfer Module.
logsource:
product: windows
service: ws_ftp_server
detection:
selection:
EventID: <RelevantEventIDForWSFTPLogon>
Message|contains: 'MFA_Bypass_Attempt'
condition: selection
fields:
- ComputerName
- User
- SourceIp
type: behavioralElastic ES|QL
from logs-windows-ws_ftp_server.*
| where message : "MFA_Bypass_Attempt"
| project @timestamp, host.name, user.name, source.ip, messageSecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.