Windows FTP Service CVE-2026-49172

Exploitation requires the target host to have the Microsoft Windows FTP service installed, enabled, and network-reachable by the attacker - this optional IIS FTP role is not present or running in a default Windows installation, which is the primary factor limiting real-world exposure. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), once the service is reachable there are no further prerequisites: no authentication, no privileges, and no user interaction are needed, and exploitation works against the service's standard configuration. The realistic constraint for defenders is therefore whether the FTP service is deployed and exposed, not the difficulty of the attack itself.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a worst-case profile: network-reachable, low complexity, no privileges, no user interaction, with full confidentiality, integrity, and availability impact - hence the 9.8 score. Countervailing signals temper the raw severity: no EPSS score was provided, the CVE is not in CISA KEV, and no POC or public exploit is identified at time of analysis, so exploitation is currently theoretical rather than observed. A key limiting factor not reflected in the CVSS score is that the FTP service is an optional IIS role that is not installed or enabled by default, so the exploitable population is far smaller than the ubiquitous Windows install base implies. On balance this is a genuine high priority for any organization actually running the Windows FTP service exposed to untrusted networks, but a lower practical concern for the majority of Windows systems where the service is absent. EPSS is missing from the input and should be checked before finalizing prioritization.

An attacker who can reach an exposed Windows FTP service over the network sends a crafted FTP command containing an oversized or malformed argument that overflows a heap buffer during parsing, corrupting adjacent heap structures. By shaping the heap and overflow contents, the attacker redirects execution to run arbitrary code in the FTP service context - all without any credentials or user interaction. No public exploit is identified at time of analysis, so this remains a plausible but unproven attack path.