Description
Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1
Published: 2026-04-27
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

Cerberus FTP Server contains an insecure permission handling flaw that allows local users to elevate privileges by exploiting incorrectly preserved inherited file permissions. The vulnerability can lead to unauthorized access to restricted files and configuration data, potentially compromising the integrity and confidentiality of the system. The flaw is based on CWE-278 – Insecure Permissions.

Affected Systems

All installations of Cerberus FTP Server up to and including version 2025.4.2 running on Windows are susceptible. The vulnerability has been fixed in version 2026.1 and later releases.

Risk and Exploitability

The CVSS score of 7.3 marks this as a high‑risk issue. EPSS data are not available, and it is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation to date. The likely attack vector is local; an attacker with local access can manipulate permissions to gain elevated rights. Although no public exploit is known, the severity and the nature of the flaw warrant immediate remediation.

Generated by OpenCVE AI on April 28, 2026 at 04:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch by upgrading to Cerberus FTP Server 2026.1 or later.
  • If an upgrade cannot be performed immediately, audit and correct the file system permissions on the server, ensuring that no inherited ACL grants excessive rights and that the Cerberus service runs under a dedicated low‑privilege account.
  • Remove or restrict administrative privileges from local user accounts that have access to the FTP server to enforce the principle of least privilege.

Generated by OpenCVE AI on April 28, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 07 May 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Cerberusftp
Cerberusftp ftp Server
CPEs cpe:2.3:a:cerberusftp:ftp_server:*:*:*:*:*:*:*:*
Vendors & Products Cerberusftp
Cerberusftp ftp Server
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 28 Apr 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Cerberus
Cerberus cerberus Ftp Server
Vendors & Products Cerberus
Cerberus cerberus Ftp Server

Mon, 27 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Apr 2026 13:30:00 +0000

Type Values Removed Values Added
Description Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1
Title Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2
Weaknesses CWE-278
References
Metrics cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Cerberus Cerberus Ftp Server
Cerberusftp Ftp Server
cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC-FI

Published:

Updated: 2026-04-27T13:58:14.228Z

Reserved: 2026-04-14T05:18:04.414Z

Link: CVE-2026-6265

cve-icon Vulnrichment

Updated: 2026-04-27T13:58:05.875Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-27T14:16:51.153

Modified: 2026-05-07T02:18:35.547

Link: CVE-2026-6265

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T04:30:21Z

Weaknesses