CVE-2026-6265: Cerberus FTP Server Privilege Escalation

CVE-2026-6265 Overview

CVE-2026-6265 is a local privilege escalation vulnerability in Cerberus FTP Server running on Windows. The flaw stems from insecure preserved inherited permissions on installation directories or related artifacts, classified under [CWE-278] (Insecure Preserved Inherited Permissions). A local authenticated attacker can leverage these weak permissions to escalate privileges on the host. Cerberus FTP Server 2026.1 resolves the issue.

Critical Impact
Successful exploitation grants an attacker elevated privileges on the underlying Windows host, leading to high impact on confidentiality, integrity, and availability of the FTP service and the system it runs on.

Affected Products

Cerberus FTP Server on Windows (versions prior to 2026.1)
Vendor: cerberusftp
Component: cerberusftp:ftp_server

Discovery Timeline

2026-04-27 - CVE-2026-6265 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-6265

Vulnerability Analysis

The vulnerability resides in how Cerberus FTP Server preserves inherited file system permissions on Windows during installation or runtime operation. Files or directories used by the service inherit access control entries (ACEs) that grant write or modify rights to non-privileged users. Because the service executes with elevated privileges, an attacker controlling those inherited objects can influence binaries, configuration, or other resources loaded by the service.

This class of weakness, tracked as [CWE-278], typically arises when installers fail to explicitly set restrictive ACLs and instead rely on the parent directory's inherited permissions. When the parent is writable by standard users, the same permissions propagate to security-sensitive child objects.

Further technical context is documented in the Reverse C Labs Advisory.

Root Cause

The root cause is improper ACL hardening on Cerberus FTP Server files or directories on Windows. Inherited permissions from a less-restrictive parent (for example, a directory writable by Users or Authenticated Users) are preserved on files used by a privileged service account, breaking the trust boundary between standard users and the service.

Attack Vector

An attacker requires local access and low-privileged credentials on the Windows host. The attacker modifies or replaces a resource governed by the weak inherited ACL, then waits for the privileged Cerberus FTP Server service to load or execute the attacker-controlled content. User interaction is also a factor in the vector. Exploitation results in code execution in the security context of the service, effectively yielding privilege escalation to SYSTEM or the service account.

No public proof-of-concept code is referenced in the advisory; the vulnerability is described in prose by the vendor and Reverse C Labs.

Detection Methods for CVE-2026-6265

Indicators of Compromise

Unexpected modifications to files within the Cerberus FTP Server installation directory by non-administrative user accounts.
New or replaced executables, DLLs, or configuration files inside the Cerberus FTP Server program directory.
Cerberus FTP Server service processes spawning child processes that run as SYSTEM but originate from user-writable paths.

Detection Strategies

Audit ACLs on the Cerberus FTP Server installation directory using icacls and flag any entries granting write or modify rights to Users, Authenticated Users, or Everyone.
Enable Windows file system auditing (Event ID 4663) on the Cerberus FTP Server directory to record write attempts by non-privileged accounts.
Correlate process creation events (Event ID 4688 / Sysmon Event ID 1) where the parent is the Cerberus service and the child image path is in a user-writable location.

Monitoring Recommendations

Monitor service binary integrity for Cerberus FTP Server and alert on hash changes outside of patch windows.
Track local privilege escalation patterns on Windows endpoints with behavioral analytics; the Singularity Endpoint behavioral AI engine identifies anomalous service-context process executions originating from user-writable paths.
Forward Windows security and Sysmon logs to a centralized data lake such as Singularity Data Lake to correlate ACL abuse with subsequent privileged process activity.

How to Mitigate CVE-2026-6265

Immediate Actions Required

Upgrade Cerberus FTP Server to version 2026.1 or later on all Windows hosts.
Inventory Windows systems running Cerberus FTP Server and prioritize internet-exposed or multi-user systems.
Review and harden ACLs on the Cerberus FTP Server installation directory, removing inherited write permissions for non-administrative principals.
Restrict interactive and remote login on hosts running Cerberus FTP Server to administrative users only.

Patch Information

The vendor has resolved CVE-2026-6265 in Cerberus FTP Server 2026.1. Refer to the Cerberus FTP Server Release Notes for upgrade details and the Reverse C Labs Advisory for technical background.

Workarounds

Manually tighten NTFS permissions on the Cerberus FTP Server installation directory so that only SYSTEM and Administrators retain write or modify rights.
Disable permission inheritance on sensitive subdirectories and explicitly assign restrictive ACEs.
Limit which local accounts can log on to the server, reducing the pool of users able to abuse the inherited permissions.

bash

# Example: harden ACLs on the Cerberus FTP Server install directory (run as Administrator)
icacls "C:\Program Files\Cerberus LLC\Cerberus FTP Server" /inheritance:r
icacls "C:\Program Files\Cerberus LLC\Cerberus FTP Server" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"