CVE-2026-67193 Xlight CVE debrief

Who should care

Defenders responsible for Xlight FTP Server instances, particularly those in environments where FTP is used for file transfer or server management, should assess exposure and potential impact.

Why it matters

CVE-2026-67193 is a medium-severity information disclosure vulnerability in Xlight FTP Server before version 3.9.5. Defenders should verify exposure, assess potential impact, and consider upgrading to mitigate risks.

• Potential information disclosure through timing data leakage
• Verification of Xlight FTP Server version and configuration required
• Monitoring of FTP server logs for suspicious activity recommended
• Possible upgrade to version 3.9.5 or later necessary

Technical summary

The vulnerability allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix, triggering the admin protocol path within the standard FTP listener pre-authentication. This leaks timing information from the FTP 331 response without requiring a separate port or configuration change. The vulnerability affects Xlight FTP Server before version 3.9.5 and can be mitigated by upgrading to version 3.9.5 or later. Defenders should verify exposure, assess potential impact, and consider upgrading to mitigate risks.

Defensive priority

Defenders should prioritize verifying exposure of Xlight FTP Server instances and assessing the potential impact of information disclosure on their organization.

Recommended defensive actions

• Verify Xlight FTP Server version and configuration
• Assess potential impact of information disclosure
• Monitor FTP server logs for suspicious activity
• Consider upgrading to version 3.9.5 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the corpus lacks specific information on affected versions, exploitation, and remediation. Defenders should verify Xlight FTP Server version and configuration, assess potential impact, and monitor FTP server logs for suspicious activity. The information disclosure vulnerability allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. This vulnerability affects Xlight 3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.