CVE-2026-67191 Xlight CVE debrief

Who should care

System administrators and security teams responsible for FTP server infrastructure, particularly those using Xlight FTP Server, should assess their exposure and take necessary actions to mitigate this critical vulnerability.

Why it matters

CVE-2026-67191 is a critical vulnerability in Xlight FTP Server before 3.9.5, allowing remote unauthenticated attackers to exploit a heap buffer overflow via a malformed SSH client identification string. System administrators and security teams should assess exposure and apply necessary patches or mitigations to prevent potential compromise or data exposure.

• Potential for remote code execution or denial of service
• Exposure of sensitive data or unauthorized access
• Compromise of FTP server integrity
• Need for immediate patching or mitigation

Technical summary

The vulnerability exists in Xlight FTP Server versions before 3.9.5, where a logic error in the recv loop's termination condition allows remote unauthenticated attackers to exploit a heap buffer overflow via a malformed SSH client identification string. This issue arises from using an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.

Defensive priority

Immediate attention is required to assess exposure and apply necessary patches or mitigations.

Recommended defensive actions

• Assess exposure of Xlight FTP Server instances to this vulnerability
• Verify if running versions are before 3.9.5 and apply patches or updates if necessary
• Implement compensating controls such as restricting SSH/SFTP access until patches are applied
• Monitor for potential exploitation attempts
• Perform an asset inventory to identify all instances of Xlight FTP Server
• Review and track exceptions for remediated assets
• Plan to roll back changes if patching is not feasible within the change window

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3 and the affected product, Xlight FTP Server. However, specific details about the vendor and affected versions are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.