CVE-2026-6265
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation. This issue has been resolved in Cerberus FTP Server: 2026.1.
Risk Assessment
Privilege escalation may lead to unauthorized access to the system and data, posing a significant security threat to the organization.
Recommendation
It is recommended to upgrade Cerberus FTP Server to version 2026.1 or later to mitigate this vulnerability.
Other vulnerabilities in Cerberus FTP Server
See all- CVE-2017-6367High
In Cerberus FTP Server version 8.0.10.1, a crafted HTTP request causes the Windows service to crash. The attack involves a long Host header and an invalid Content-Length header.
- CVE-2017-6880Critical
Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.
- CVE-2026-82819High
A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share path, an attacker can coerce authentication against the underlying server, resulting in leakage of the Cerberus service account's Net-NTLMv2 hash.
Original NVD description (English source)
Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1
Vulnerability data from NVD (NIST) · CISA KEV · EPSS