Vulnerability details

CVE-2026-6265

Cerberus FTP Server

Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2

CVSS 4.0

7.3High

Official description

Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1

CVSS scores

Score	Version	Source	Vector
7.3High	4.0	CVEProject cvelistV5 (CNA) (NCSC-FI)	`CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Affected products

Vendor	Product	Versions	Source
Cerberus	Cerberus FTP Server	v ≤ 2025.4.2	CVEProject cvelistV5 (CNA)

References and advisories

https://www.cerberusftp.com/releasenotes/ release-notes
https://labs.reversec.com/advisories/2026/04/cerberus-ftp-server-elevation-of-privileges third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-04-27
Last updated: 2026-04-27
State: Published
Assigner (CNA): NCSC-FI

Exploit prediction (EPSS)

0.26%

Probability of exploitation in 30 days

17.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-278
Insecure preserved inherited permissions