CVE-2026-67193mediumCWE-203

CVE-2026-67193: medium-severity vulnerability in Xlight FTP Server

Xlight FTP Server < 3.9.5 Information Disclosure via USER Command

Published · Updated

Follow this CVE+ Monitor Xlight FTP Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.4%
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. Attackers can trigger the admin protocol path within the standard FTP listener pre-authentication to leak timing information from the FTP 331 response without requiring a separate port or configuration change.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Xlight · Xlight FTP Server
Related CVEs — Xlight FTP Server

In the same product, most dangerous first.

CVE-2026-67192CRITICALXlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM CipherEPSS 1.0%CVE-2026-67191CRITICALXlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH ParserEPSS 1.0%