CVE-2026-6265: Cerberus FTP Server Privilege Escalation

CVE-2026-6265 Overview

CVE-2026-6265 is a privilege escalation vulnerability affecting Cerberus FTP Server on Windows systems. The vulnerability stems from insecure preserved inherited permissions (CWE-278), which can allow a local attacker with low privileges to escalate their access to higher privilege levels on the affected system.

This vulnerability requires local access to the system and some user interaction to exploit, but successful exploitation can result in complete compromise of confidentiality, integrity, and availability on both the vulnerable system and potentially connected systems.

Critical Impact

Local privilege escalation through insecure inherited permissions could allow attackers to gain elevated system access on Windows servers running Cerberus FTP Server.

Affected Products

• Cerberus FTP Server versions prior to 2026.1 on Windows

Discovery Timeline

• 2026-04-27 - CVE-2026-6265 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-6265

Vulnerability Analysis

The vulnerability exists due to improper handling of inherited permissions within Cerberus FTP Server on Windows platforms. When file or directory permissions are preserved during certain operations, the inherited Access Control List (ACL) entries are not properly sanitized or restricted. This creates a security gap where lower-privileged users can exploit the improperly inherited permissions to access or modify resources they should not have access to.

CWE-278 (Insecure Preserved Inherited Permissions) describes a condition where a product does not properly restrict permissions when creating or copying objects, allowing inherited permissions to persist in an insecure manner. In the context of Cerberus FTP Server, this can manifest when the application creates files, directories, or configuration objects that inherit overly permissive ACLs from parent directories or the installation context.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize or restrict inherited Windows NTFS permissions when the Cerberus FTP Server creates or manages resources. When objects are created, they inherit permissions from their parent container. If the parent container has overly permissive ACLs, or if the application does not explicitly set restrictive permissions on newly created objects, these insecure permissions propagate, creating an exploitable condition.

Attack Vector

This vulnerability requires local access to the Windows system where Cerberus FTP Server is installed. An attacker with low-privilege access to the system could identify files or directories with improperly inherited permissions. By leveraging these misconfigured ACLs, the attacker could:

1. Modify configuration files to inject malicious settings
2. Replace executable components with malicious versions
3. Access sensitive data stored by the FTP server
4. Escalate privileges by manipulating service-related files or registry entries

The attack requires some level of user interaction (such as triggering a service restart or file operation), but successful exploitation can lead to complete system compromise with high impact to confidentiality, integrity, and availability.

For detailed technical information about this vulnerability, refer to the ReverseC Advisory.

Detection Methods for CVE-2026-6265

Indicators of Compromise

• Unexpected modifications to Cerberus FTP Server configuration files or installation directories
• Unusual permission changes on FTP server-related files and folders
• Evidence of low-privileged users accessing restricted Cerberus FTP Server resources
• Suspicious service restarts or configuration changes in Windows Event Logs

Detection Strategies

• Monitor Windows Security Event Logs for permission changes (Event IDs 4663, 4670) on Cerberus FTP Server installation directories
• Implement file integrity monitoring on critical Cerberus FTP Server files and configurations
• Use Windows icacls or similar tools to audit ACLs on FTP server directories for overly permissive inherited permissions
• Configure SentinelOne agents to detect suspicious privilege escalation patterns on systems running Cerberus FTP Server

Monitoring Recommendations

• Enable detailed auditing on the Cerberus FTP Server installation directory and configuration files
• Set up alerts for unauthorized access attempts to FTP server resources by non-administrative users
• Regularly audit user privileges and group memberships on systems running vulnerable versions
• Monitor for execution of administrative commands by unexpected user accounts

How to Mitigate CVE-2026-6265

Immediate Actions Required

• Upgrade Cerberus FTP Server to version 2026.1 or later immediately
• Audit and remediate permissions on existing Cerberus FTP Server installation directories
• Review inherited permissions on all FTP server-related files and remove overly permissive ACLs
• Restrict local access to systems running Cerberus FTP Server to only authorized administrators

Patch Information

Cerberus LLC has addressed this vulnerability in Cerberus FTP Server version 2026.1. Organizations should prioritize upgrading to this version or later to remediate the vulnerability. For detailed release information, refer to the Cerberus FTP Release Notes.

Workarounds

• Manually review and tighten NTFS permissions on the Cerberus FTP Server installation directory using Windows icacls
• Disable permission inheritance on critical directories and explicitly set restrictive ACLs
• Limit local user access to FTP server systems until the patch can be applied
• Implement additional access controls using Windows Group Policy or third-party endpoint protection

# Example: Audit and reset permissions on Cerberus FTP installation directory
icacls "C:\Program Files\Cerberus LLC\Cerberus FTP Server" /reset /T /C
icacls "C:\Program Files\Cerberus LLC\Cerberus FTP Server" /inheritance:d
icacls "C:\Program Files\Cerberus LLC\Cerberus FTP Server" /grant:r Administrators:F /grant:r SYSTEM:F