Which versions of Cerberus FTP Server are affected by CVE-2026-6265?

Cerberus FTP Server on Windows (versions through 2025.4.2) contains a local privilege escalation vulnerability that allows low-privileged users to gain elevated system access.

How to fix or mitigate CVE-2026-6265?

Within 24 hours, identify and inventory all systems running Cerberus FTP Server versions 2025.4.2 or earlier. Within 7 days, deploy Cerberus FTP Server version 2026.1 to all affected systems and validate the update across the environment. Within 30 days, audit FTP access logs and system privilege escalation logs for any evidence of exploitation attempts.

Cerberus FTP Server CVE-2026-6265

Q: What is the CVSS score of CVE-2026-6265?

CVE-2026-6265 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25849 HIGH

Insecure Preserved Inherited Permissions (CWE-278)

2026-04-27 NCSC-FI

Privilege Escalation Microsoft Cerberus Ftp Server Cerberus

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Local vector with an existing low-privilege account (PR:L), high complexity and required interaction reflecting the non-instant ACL-abuse trigger (AC:H/UI:R), full compromise on success (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:00 vuln.today

CVSS changed

Apr 27, 2026 - 14:22 NVD

7.3 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 13:30 euvd

EUVD-2026-25849

CVE Published

Apr 27, 2026 - 13:00 nvd

HIGH 7.3

DescriptionCVE.org

Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1

AnalysisAI

Local privilege escalation in Cerberus FTP Server on Windows (all builds through 2025.4.2) lets a low-privileged local user leverage insecurely preserved inherited filesystem permissions to gain higher privileges on the host. The SSVC framework records a proof-of-concept exploit (published by Reversec Labs) with total technical impact, though EPSS estimates real-world exploitation probability at just 0.01%. The issue is fixed in release 2026.1.

Technical ContextAI

Cerberus FTP Server is a commercial Windows-based FTP/FTPS/SFTP/HTTPS file-transfer server. The root cause is classified as CWE-278 (Insecure Inherited Permissions): when the installer or the running service creates files, directories, or registry objects, those objects inherit permissive ACLs from a parent object rather than being locked down to privileged accounts. On Windows this class of flaw typically means a standard user has write access to a resource (e.g., an executable, service binary path, DLL search location, or configuration file) that runs in a higher-privileged context, so the low-privileged user can substitute attacker-controlled content that is later executed with elevated rights. The single CPE, cpe:2.3:a:cerberus:cerberus_ftp_server:*:*:*:*:*:*:*:*, confirms the affected product is the Cerberus FTP Server application itself.

RemediationAI

Vendor-released patch: 2026.1 - upgrade Cerberus FTP Server to 2026.1 or later, which corrects the insecure inherited-permission behavior; consult the release notes at https://www.cerberusftp.com/releasenotes/ and the Reversec advisory at https://labs.reversec.com/advisories/2026/04/cerberus-ftp-server-elevation-of-privileges. Until the upgrade can be applied, compensating controls should focus on the ACL weakness: audit and tighten NTFS permissions on the Cerberus installation directory, service executable path, and any writable data/config directories so that non-administrative users have no write or modify rights (this prevents binary/DLL/config substitution but may break installer-driven updates that rely on those inherited ACLs), and restrict interactive and remote logon on the host so only trusted administrators have local access (reducing the pool of accounts able to stage the attack, at the cost of operational convenience). These are stopgaps; upgrading to 2026.1 is the definitive fix.