CVE-2026-119568

Name of the Vulnerable Software and Affected Versions vsftpd versions prior to 3.0.6

Description An authentication bypass exists in the ssl data accept() function. Unauthenticated attackers who share the same source IP address as a victim can hijack FTPS data connections by resuming their own TLS session ticket. This is achieved by obtaining a ticket via AUTH TLS and then connecting to the victim's PASV port, enabling the attacker to steal downloaded files or inject data into uploads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.