Live › vulnerability › CVE-2026-109681
Go to dashboardThe FTP client accepts the IP address and port in a server's 227 Passive Mode response without checking them against the server it is connected to. A rogue FTP server can therefore make the client open a TCP connection to any host and port the attacker chooses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
This page as .md · .json · in your agent: get_signal("CVE-2026-109681")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.