External risk intelligence

Xlight FTP Server Pre-Authentication Heap Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67191

The vulnerability affects an FTP and SSH/SFTP server, which are designed to be internet-facing services for remote file transfer. Because the flaw is reachable via a pre-authentication command, it exposes an unauthenticated network service that is commonly deployed on the public internet to facilitate external access.

Buffer Overflow

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Xlight FTP Server affecting its SSH functionality. This flaw could allow unauthenticated attackers to disrupt server operations by sending specially crafted network traffic. The main concern is to confirm if this type of server is in use and exposed to potential threats.

A flaw allows remote access to disrupt server operations.
It affects an internet-facing service commonly used for file transfers.
Confirm relevance and potential exposure to the business.

Attack Path

How an attacker could exploit the issue

An attacker can target an exposed FTP server by sending specially crafted network traffic. This traffic is designed to exploit a flaw in how the server handles incoming SSH client identification strings before a user even logs in. By exploiting this, an attacker could trigger a buffer overflow, potentially leading to severe consequences for the server.

Triggered by malformed SSH identification string.
Exploitable over any SSH or SFTP connection.
Risk of heap overflow before authentication.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to impact the service by overwriting memory on the server when sending a specially crafted SSH client identification string. This could lead to service instability or potentially more severe consequences on any SSH or SFTP connection before authentication.

Service stability and memory integrity.
Malformed SSH client identification string.
Denial of service or unpredictable behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Xlight FTP Server, a network-facing service commonly exposed externally, is susceptible to a pre-authentication heap buffer overflow. Responsibility for addressing this critical vulnerability likely falls to infrastructure or platform teams managing the server, alongside security teams for exposure assessment. The immediate first step involves identifying all instances of the affected technology, confirming their reachability and business criticality, and then formally assigning ownership for remediation planning.

Infrastructure or platform teams own remediation.
Verify external reachability and business impact.
Plan for vendor coordination and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Xlight FTP Server?

Xlight FTP Server is a software application designed to handle file transfers over a network. It supports standard protocols like FTP, but also provides SSH and SFTP capabilities for secure connections. Administrators typically deploy this software to allow remote users or systems to upload and download files securely between different environments.

What does heap buffer overflow mean for CVE-2026-67191?

This vulnerability, classified as CWE-122, occurs when the software writes more data to a specific area of memory, known as the heap, than it is designed to hold. Because of a logic error in how the server processes incoming data, the system fails to stop writing at the correct time. In the context of this CVE, this can corrupt memory and lead to service instability or other unpredictable outcomes when processing connection requests.

How is this vulnerability triggered by an attacker?

An attacker triggers this flaw by sending a specifically malformed SSH client identification string to the server. This happens during the initial connection phase, meaning it occurs before any user credentials are required. It is important to note that this bug affects any SSH or SFTP connection attempt; simply initiating a connection is enough to expose the server to the malformed data.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is very likely to be a concern because Xlight FTP Server is inherently designed to be an internet-facing service. Since the vulnerability is reachable without authentication, any instance of this server that is exposed to the public internet for remote file access is considered a primary target for this type of network-based attack.

What should I do if I run Xlight FTP Server?

Your first step is to create an inventory of all systems running Xlight FTP Server in your environment. Once identified, confirm which instances are reachable from the internet or other untrusted networks. Coordinate with your infrastructure or platform teams to prioritize these servers for remediation and check for official software updates that address the logic error in the connection handling process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.