SecBoard
Zurück zur CVE-Übersicht

CVE-2026-90863

CRITICAL(9.1)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Risk Signal Score23/100 — NIEDRIG
  • CVSS 9.1 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.7%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.1

Technische Schwere

Beschreibung

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 2024.0.7
  • 2025.0.4

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "WS_FTP.exe" or InitiatingProcessCommandLine contains "WS_FTP"
| where FileName in ("cmd.exe", "powershell.exe") or ProcessCommandLine contains "/c" or ProcessCommandLine contains "-command"
| summarize count() by DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1) (ParentProcessName="WS_FTP.exe" OR ParentCommandLine="*WS_FTP*") (ProcessName IN ("cmd.exe", "powershell.exe") OR CommandLine="*/c*" OR CommandLine="*-command*")
| stats count by Host, ParentCommandLine, ProcessName, CommandLine

Sigma

title: WS_FTP Server - Possible Privilege Escalation via Command Execution
status: experimental
description: Detects suspicious command execution originating from WS_FTP Server processes, potentially indicating privilege escalation.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\\WS_FTP.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
  condition: selection

Elastic ES|QL

from process where event.type == "start" and (process.parent.executable == "WS_FTP.exe" or process.parent.command_line : "*WS_FTP*") and (process.executable in ("cmd.exe", "powershell.exe") or process.command_line : ("*/c*", "*-command*"))
| stats count() by host.name, process.parent.command_line, process.executable, process.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen