CVE-2026-67192: Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher
Xlight · Xlight FTP Server
Fixed in 3.9.5 · Affected: Xlight FTP Server before 3.9.5 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 64% of scored CVEs
DescriptionNVD
Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Published
- July 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 4 Aug.
- Xlight FTP Server bug CVE-2026-67192 allows remote code executionSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.