CVE-2026-67192Disclosure

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achieve remote code execution before any authentication occurs.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-121

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 3d ago at 2 mentions (2026-07-29); latest day: 1
5 total mentions across 4 days

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

480.0%

Patch

120.0%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	2	Disclosure2
2026-07-30	1	Disclosure1
2026-08-04	1	Patch1
2026-08-05	1	Disclosure1

Full discourse5 posts

FOFA@fofabot85d
Disclosure
⚠️⚠️ CVE-2026-67191 (CVSS 9.8) + CVE-2026-67192 (CVSS 9.2): Pre-authentication buffer overflows in Xlight FTP Server allow unauthenticated RCE via malformed SSH packets before any login occurs 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJYbGlnaHQtRlRQIg%3D%3D 🎯60.5K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="Xlight-FTP" 🔖Refer: https://www.vulncheck.com/advisories/xlight-ftp-server-pre-auth-heap-buffer-overflow-via-ssh-parser #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post discloses two high‑severity CVEs for Xlight FTP Server (CVE-2026-67191 and CVE-2026-67192), detailing pre‑authentication buffer overflow vulnerabilities that can enable unauthenticated remote code execution via malformed SSH packets.
19022105.1K
14.8K followersView on X
Daily CyberSecurity@Daily_CyberSec86d
Patch
A critical Xlight FTP Server flaw, CVE-2026-67192, is a pre-authentication stack buffer overflow that risks remote code execution. Update to 3.9.5 now. #XlightFTP #CVE202667192 #BufferOverflow #RCE #Vulnerability #InfoSec http://securityonline.info/xlight-ftp-cve-2026-67192/
Post summary
A critical pre‑authentication buffer overflow in Xlight FTP Server (CVE-2026-67192) allows remote code execution; the vendor released patch 3.9.5.
00020444
13.0K followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-67192 Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by send… https://www.cve.org/CVERecord?id=CVE-2026-67192
Post summary
This statement discloses CVE-2026-67192: a pre‑authentication stack buffer overflow vulnerability in Xlight FTP Server versions prior to 3.9.5, offering attackers the potential to corrupt stack memory.
00010499
57.9K followersView on X
MalwareObserver@MalwareObserver90d
Disclosure
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-67192](https://www.vulncheck.com/advisories/xlight-ftp-server-pre-auth-stack-buffer-ove... https://www.vulncheck.com/advisories/xlight-ftp-server-pre-auth-stack-buffer-overflow-via-ssh-gcm-cipher #Vulnerability #CVE #ZeroDay
Post summary
The message announces CVE‑2026‑67192, a pre‑authentication stack buffer overflow in XLight FTP via SSH GCM cipher, and directs readers to a detailed advisory on vulncheck.com.
0000056
17 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-67192 Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by send… https://www.cve.org/CVERecord?id=CVE-2026-67192 ----- Traducción: CVE-2026-67192 Xli… http://infoflow.cloud`
Post summary
The post announces a pre‑authentication stack buffer overflow in Xlight FTP Server versions prior to 3.9.5, allowing unauthenticated attackers to corrupt stack memory.
0000031
96 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-67192

FOFA[verified]@fofabotDisclosure

The post discloses two high‑severity CVEs for Xlight FTP Server (CVE-2026-67191 and CVE-2026-67192), detailing pre‑authentication buffer overflow vulnerabilities that can enable unauthenticated remote code execution via malformed SSH packets.

MalwareObserver[verified]@MalwareObserverDisclosure

The message announces CVE‑2026‑67192, a pre‑authentication stack buffer overflow in XLight FTP via SSH GCM cipher, and directs readers to a detailed advisory on vulncheck.com.

Daily CyberSecurity@Daily_CyberSecPatch

A critical pre‑authentication buffer overflow in Xlight FTP Server (CVE-2026-67192) allows remote code execution; the vendor released patch 3.9.5.

CVE@CVEnewDisclosure

This statement discloses CVE-2026-67192: a pre‑authentication stack buffer overflow vulnerability in Xlight FTP Server versions prior to 3.9.5, offering attackers the potential to corrupt stack memory.

Infoflowcloud@infoflowcloudDisclosure

The post announces a pre‑authentication stack buffer overflow in Xlight FTP Server versions prior to 3.9.5, allowing unauthenticated attackers to corrupt stack memory.