CVE-2026-6265
Insecure Permission Inheritance in Cerberus FTP Server Enables Privilege Escalation
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: National Cyber Security Centre Finland
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cerberus | ftp_server | 2026.1 |
| cerberus_llc | cerberus_ftp_server | 2025.4.2 |
| cerberus_llc | cerberus_ftp_server | 2025.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-278 | A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6265 is a local privilege escalation vulnerability in Cerberus FTP Server on Windows. It occurs because the software update process downloads update files into a directory that inherits writable permissions from a higher-level folder, allowing low-privileged users to create and control files there.
Specifically, the update installer is saved in the folder C:\ProgramData\Cerberus LLC\Cerberus FTP Server\installers, which inherits permissions from C:\ProgramData\ that allow standard users to create and write files. A low-privileged user can pre-create a malicious executable with the same predictable filename as the update installer.
When the update process runs with local administrator privileges, it overwrites the malicious file but the original user retains ownership and permissions, enabling them to swap the legitimate executable with their malicious one. This race condition allows the malicious executable to be executed with elevated privileges, resulting in local administrator privilege escalation.
How can this vulnerability impact me? :
This vulnerability allows a low-privileged user on a system running Cerberus FTP Server to escalate their privileges to local administrator level. This means an attacker with limited access could execute malicious code with administrative rights.
With elevated privileges, the attacker could potentially take full control of the affected system, install malware, access sensitive data, modify system configurations, or disrupt services.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves insecure permissions on the update installers directory used by Cerberus FTP Server on Windows. Detection involves checking the permissions of the folder where update executables are downloaded.
Specifically, you should inspect the permissions of the directory: C:\ProgramData\Cerberus LLC\Cerberus FTP Server\installers to see if standard users (BUILTIN\Users) have write or create permissions.
On a Windows system, you can use the following commands to check permissions:
- icacls "C:\ProgramData\Cerberus LLC\Cerberus FTP Server\installers"
- PowerShell command to check ACLs: Get-Acl -Path "C:\ProgramData\Cerberus LLC\Cerberus FTP Server\installers" | Format-List
If the output shows that standard users have write or modify permissions on this directory, the system is vulnerable to this privilege escalation issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows local privilege escalation by enabling a low-privileged user to execute malicious code with administrative rights on the affected Cerberus FTP Server. This could lead to unauthorized access or modification of sensitive data managed by the server.
Such unauthorized privilege escalation and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.
Remediation by updating to the patched version is necessary to mitigate these risks and maintain compliance.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update Cerberus FTP Server to version 2026.1 or later, where this vulnerability has been resolved.
Until the update can be applied, you should restrict write permissions on the installers directory (C:\ProgramData\Cerberus LLC\Cerberus FTP Server\installers) to prevent low-privileged users from creating or modifying files there.
Additionally, avoid running the update process from low-privileged user accounts to reduce the risk of exploitation.