cyfenced.com →

[ CVE-2026-119568 · Published 30 Oct 2026 ]

Vulnerability in vsftpd

CVSS 7.4 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Interim mitigation published by PrivacySafe

[ Description ]Official description

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

[ Fixes ]Fixes and patches

  • vsftpd FTPS data channel hijackInterim mitigation · PrivacySafe · Check, mitigation, optional hardening and rollback for vsftpd 3.0.5 and older with FTPS enabled on a standalone listener, GNU/Linux

[ References ]References