Do Son 
TL;DR
Researchers disclosed three pre-authentication flaws in Xlight FTP Server. The most severe is a Xlight FTP Server flaw, CVE-2026-67192, a stack buffer overflow that may allow remote code execution. All three affect versions before 3.9.5, which fixes them.
- Product: Xlight FTP Server
- Vulnerabilities: 3 flaws (CVE-2026-67192, CVE-2026-67191, CVE-2026-67193)
- Highest severity: 9.8 (Critical · CVSSv3)
- Worst impact: < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser
- Status: No confirmed exploitation yet; patches available
- Action: Update to 3.9.5 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-67191 | 9.8 | < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser | 3.9.5 | Not exploited |
| CVE-2026-67192 | 8.1 | < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher | 3.9.5 | Not exploited |
| CVE-2026-67193 | 5.3 | < 3.9.5 Information Disclosure via USER Command | 3.9.5 | Not exploited |
Why it matters
Xlight is a Windows FTP and SFTP server built for high-volume transfers. It often sits at the network edge. So a pre-auth bug here gives remote attackers a direct path in.
Two of these flaws score above 9. Both can corrupt memory before any login, which is the worst case for a file server.
How the attacks work
Two of the bugs are memory-corruption issues that need no login. CVE-2026-67192 is a stack buffer overflow in SSH GCM cipher handling. An unvalidated length field reaches the decrypt function and overwrites the stack cookie and return address.
CVE-2026-67191 is a heap buffer overflow, rated 9.3. A logic error in the SSH receive loop uses OR where AND was required. That lets an attacker overrun a heap buffer on any SSH or SFTP connection before authentication.
A timing leak too
The third issue is milder. CVE-2026-67193 leaks the server’s tick-count timer through the FTP login response. An attacker sends a username ending in a special admin suffix to trigger it. Timing data can aid later attacks.
Affected versions
Every Xlight FTP Server build before 3.9.5 is affected. VulnCheck assigned all three CVEs on 29 July 2026. The vendor released 3.9.5 to patch them.
Patch and mitigation
Update to Xlight FTP Server 3.9.5 without delay. Check the vendor’s release notes to confirm the fixed build. Until you patch, limit exposure of the FTP and SSH ports to trusted networks. No public exploit or in-the-wild activity has been confirmed for this Xlight FTP Server flaw.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
