CVE tracker

CVE-2026-119568

CVE-2026-119568Critical 9.1Published 30 Oct 2026, 13:16

Research and translation in progress – available shortly.

Original description (NVD)

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

NVD references (3)

https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket
https://security.appspot.com/vsftpd.html
https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hija…

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.