CVE-2026-119568

{
  "etk_id": "ETK-2026-3071",
  "cve_id": "CVE-2026-119568",
  "display_id": "CVE-2026-119568",
  "ghsa_id": "GHSA-93qj-4wg6-29x9",
  "euvd_id": "EUVD-2026-113833",
  "status": "published",
  "anchor_state": "anchored",
  "title": "FTPS data-channel authentication bypass in vsftpd",
  "summary": "vsftpd through 3.0.5 has an authentication bypass affecting FTPS data connections. An unauthenticated attacker may intercept downloads or modify upload data when they share the victim's source IP and have the required TLS session state.",
  "mitigation": "No fixed version is recorded. Restrict FTPS access to trusted networks, avoid sharing FTPS source IPs among untrusted users where possible, and limit or disable passive FTPS transfers until an updated release is available.",
  "vendor": "vsftpd",
  "product": "vsftpd",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.0.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "vsftpd",
      "purl": null
    }
  ],
  "cwes": [
    940
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 39.43952385,
  "t0_at": "2026-10-30T11:31:14.408000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-30T11:31:14.408000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T11:31:14.408000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-119568"
    }
  }
}