External risk intelligence

Xlight FTP Server Pre-Authentication Stack Buffer Overflow via SSH GCM Cipher

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-67192

The vulnerability exists in an FTP server product designed to handle file transfers over the network. As an FTP server providing SSH/SFTP services, it is typically deployed as a public-facing service to facilitate remote file access, and the vulnerability is reachable pre-authentication.

Remote Code Execution

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in Xlight FTP Server affects its SSH functionality, allowing unauthenticated attackers to potentially execute code by sending specially crafted network packets. The issue lies in how the server handles encrypted data, creating a risk before any user even logs in. Understanding this vulnerability is important for assessing our exposure to potential network-based attacks targeting this type of service.

Unauthenticated code execution via SSH data.
Impacts services exposed to external networks.
Assess relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by connecting to the exposed FTP server over the network. By sending specially crafted SSH packets during the GCM cipher negotiation phase, the attacker can trigger a buffer overflow. This overflow can corrupt critical stack memory, potentially leading to remote code execution before any user authentication takes place.

Network access required.
Malformed SSH packets trigger overflow.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code on the FTP server by sending specially crafted SSH packets when a GCM cipher is negotiated. This could lead to a compromise of the server's integrity and confidentiality before any user authentication takes place.

Server stack memory could be corrupted.
Malformed SSH packets during cipher negotiation.
Potential for unauthenticated remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Xlight FTP Server impacts systems providing remote file access, making infrastructure and platform teams likely responsible for remediation. The initial step is to locate all instances of the affected server, confirm their network exposure and business criticality, identify the accountable owner, and then plan remediation based on risk assessment.

Identify accountable infrastructure or platform owners.
Verify exposure and business criticality of instances.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Xlight FTP Server?

Xlight FTP Server is a software application designed to manage and facilitate the transfer of files over a network. It supports secure protocols, including SSH/SFTP, to allow users to upload, download, and store data remotely. Because it provides these essential connectivity services, it is often installed on infrastructure that acts as a central hub for file management.

What is the weakness class for CVE-2026-67192?

This CVE involves a stack buffer overflow, which is classified as CWE-121. In simple terms, the software fails to properly check the length of incoming data before saving it into a specific area of memory called the stack. By sending a packet that is too large, an attacker can overwrite adjacent memory, including instructions the server uses to determine what code to run next.

How does an attacker trigger this buffer overflow?

The vulnerability is triggered during the initial SSH connection handshake, specifically when the server and client negotiate the use of a GCM cipher. An attacker must send a malformed SSH packet containing an unvalidated length field. Notably, this flaw does not occur if the server is configured to use different, non-GCM encryption methods or if the SSH functionality is disabled entirely.

Is my system at risk if it is not internet-facing?

Halo Surface Signal indicates this vulnerability is most relevant to services deployed for remote file access, which are commonly placed on the open internet. While the threat is lower for systems restricted to an internal network, the flaw remains present. You should assess your environment, as any entity with network access to the server could theoretically trigger the bug without needing to authenticate first.

What are the first steps to address CVE-2026-67192?

Start by identifying all instances of Xlight FTP Server running in your environment. Once identified, verify which servers are using SSH/SFTP and confirm their network exposure. Prioritize these systems for review, determine who owns the infrastructure, and follow official guidance to update to a version beyond 3.9.5 to eliminate the vulnerable code path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.