Quftp Service CVE-2026-22895

While the CVSS score and vector are not available for direct analysis, the attack vector is clearly network-based with a requirement for administrator-level authentication, which substantially reduces the real-world risk profile. The vulnerability does not appear in the CISA KEV catalog, and no public proof-of-concept has been widely reported, further lowering immediate exploitation probability. However, the vulnerability's classification as XSS combined with its presence in multiple product branches and lack of EPSS data suggests moderate concern for organizations running unpatched QuFTP Service instances. The remediation appears straightforward (patching to specific versions), but the administrative access requirement means this is primarily a privilege escalation or insider threat vector rather than a primary attack entry point. Organizations should prioritize patching based on their own risk appetite and whether QuFTP Service is exposed to untrusted administrator accounts.

An attacker who has obtained or brute-forced administrator credentials to a QuFTP Service instance could craft a malicious URL containing JavaScript payload and send it to another administrator user. If the second administrator visits the link while logged into QuFTP Service, the injected script would execute in their browser session with administrator privileges, potentially allowing the attacker to steal session tokens, modify administrative settings, or exfiltrate sensitive files stored on the server. This attack chain requires either credential compromise or insider threat scenarios, making it a secondary rather than primary attack vector.