Cerberus FTP Server CVE-2026-6265

Requires an authenticated low-privileged local account (PR:L) with local access to the Windows host running a vulnerable Cerberus FTP Server (≤2025.4.2); remote-only attackers cannot exploit this. The flaw hinges on the insecurely preserved inherited ACLs on Cerberus files/directories/registry objects, so exploitation depends on those objects being writable by the low-privileged user in the target's specific installation, and the CVSS vector further indicates an attack requirement (AT:P) plus passive user interaction (UI:P) - meaning the escalation is triggered when a higher-privileged process or administrator action consumes the attacker-modified resource, rather than firing instantly on demand. Limiting factors: no network vector, a pre-existing local foothold is mandatory, the non-instant trigger reduces reliability, and hosts where the installation directory ACLs have been hardened are not exploitable.

The signals point to a genuine but low-urgency issue. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:P) scoring 7.3 shows this is local, requires an already-authenticated low-privileged foothold, and depends on both a specific attack requirement (AT:P) and passive user interaction (UI:P) - it is not a remote, unauthenticated, one-shot exploit. SSVC aligns with this: exploitation is only 'poc' (not active), automatable is 'no', but technical impact is 'total' (full SYSTEM/admin compromise once triggered). EPSS is 0.01% (1st percentile) and there is no CISA KEV listing, so widespread opportunistic exploitation is unlikely. Net assessment: a real, high-impact-if-exploited local privilege escalation that matters most on multi-user or shared Windows hosts, but it is a routine-priority patch rather than an emergency. No conflicting data was observed; note the score is CVSS 4.0 (no 3.1 vector supplied), and the specific escalation mechanism is not detailed in the NVD description.

A low-privileged user (or a limited-service account already present on the Windows server) discovers that a Cerberus-related file, service binary path, or directory is writable due to inherited permissions, replaces it with an attacker-controlled payload, and waits for the higher-privileged Cerberus service or an administrative action to execute it - yielding SYSTEM/administrator-level control. A proof-of-concept demonstrating this chain has been published by Reversec Labs. Because the CVSS vector is AV:L/PR:L with an attack requirement and user interaction, the attacker must already have a local foothold and the trigger conditions must be met.