Which versions of Xlight FTP Server are affected by CVE-2026-67191?

Xlight FTP Server before version 3.9.5 contains a critical pre-authentication heap buffer overflow vulnerability (CVSS 9.3) that allows unauthenticated remote attackers to potentially execute code on…. A patch is available.

How to fix or mitigate CVE-2026-67191?

Within 24 hours: Inventory all Xlight FTP Server installations and identify those running versions before 3.9.5; immediately disable SSH and SFTP services or implement strict firewall rules limiting access to trusted IP ranges only. Within 7 days: Contact Xlight vendor to confirm patch release timeline and begin evaluating alternative secure file transfer solutions such as SFTP over VPN or managed file transfer appliances; deploy endpoint detection and response (EDR) and network-based intrusion detection signatures for this vulnerability class. Within 30 days: Establish a mandatory upgrade path to Xlight FTP Server 3.9.5 or later once patches are released, or execute migration to a patched alternative; document all network isolation changes and monitoring rules implemented during the interim period.

Xlight FTP Server CVE-2026-67191

Q: What is the CVSS score of CVE-2026-67191?

CVE-2026-67191 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-50398 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-29 VulnCheck

GHSA-2w83-j663-7qg5

Buffer Overflow Heap Overflow Xlight Xlight Ftp Server

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, pre-auth, no-interaction network banner parsing (AV:N/AC:L/PR:N/UI:N); heap overflow enables potential code execution with full C/I/A impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 29, 2026 - 17:02 EUVD

Analysis Generated

Jul 29, 2026 - 16:27 vuln.today

CVE Published

Jul 29, 2026 - 15:50 cve.org

CRITICAL 9.3

DescriptionCVE.org

Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses an incorrect OR operator where an AND operator is required, enabling exploitation on any SSH or SFTP connection before authentication occurs.

AnalysisAI

Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write past a heap buffer by sending a malformed SSH client identification string over any SSH or SFTP connection. The flaw is a logic error in the recv-loop termination condition (an OR used where AN AND is required), triggering before authentication and creating strong potential for remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Xlight FTP Server is a commercial Windows FTP/SFTP/FTPS server that embeds its own SSH transport implementation to support SFTP. During the SSH protocol handshake, the client first sends an identification string (the 'SSH-2.0-...' banner) that the server reads in a receive loop before any key exchange or authentication. Per the advisory, the loop's termination check uses an incorrect boolean operator (OR instead of AND), so the loop fails to stop at the correct buffer boundary and copies attacker-controlled data past the end of a heap-allocated buffer. This maps to CWE-122 (Heap-based Buffer Overflow): a classic memory-safety defect where insufficient bounds checking on network-controlled input corrupts adjacent heap metadata or allocations. Because the parsing occurs in the pre-auth banner-exchange phase, no credentials or session state are needed to reach the vulnerable code. The CPE cpe:2.3:a:xlight:xlight_ftp_server:*:*:*:*:*:*:*:* covers the Xlight FTP Server application across all versions prior to the fixed release.

RemediationAI

Vendor-released patch: upgrade to Xlight FTP Server 3.9.5 or later, which corrects the recv-loop termination logic; the fix is noted in the vendor changelog at https://www.xlightftpd.com/whatsnew.htm and analyzed at https://www.vulncheck.com/advisories/xlight-ftp-server-pre-auth-heap-buffer-overflow-via-ssh-parser. Where immediate upgrade is not possible, restrict exposure of the SSH/SFTP listener: block or firewall the SFTP/SSH port (default TCP 22, or whatever custom port is configured) at the network edge and allow only trusted management IP ranges via an allowlist, accepting that this breaks remote SFTP access for legitimate off-net clients. If SFTP is not actually used, disable the SSH/SFTP protocol module in the Xlight configuration entirely so the vulnerable pre-auth parser is never reached, leaving plain FTP/FTPS unaffected. Because the overflow occurs before authentication, credential hardening and account lockouts provide no protection - network reachability is the only meaningful control until patched.