Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

vsftpd allows hijacking of FTPS data transfers

CVE-2026-119568 · published 3 days ago
Summary

The vsftpd file transfer server (versions up to 3.0.5) can be tricked into letting an attacker take over the encrypted data channel. This lets someone who knows the victim's IP intercept or modify files being uploaded or downloaded without logging in. Apply the latest update or disable the vulnerable SSL reuse setting to stop the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– vsftpd vsftpd <= 3.0.5
Debian:12 debian vsftpd All versions
Original advisory text
vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-940Improper Verification of Source of a Communication Channel
Timeline
Published30 Oct 2026
Updated2 Nov 2026
First seen30 Oct 2026
Sources
CVE-2026-119568 · NVD
CVE-2026-119568 · MITRE
DEBIAN-CVE-2026-119568 · OSV
Track software like this
Free during beta