CVE-2026-102727

MediumCVSS 6.0

Published: 29/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

FTP Passive Data Connection Not Bound to the Authenticated Control Peer. This means the passive data connection may be established with a different host than the one that authenticated, potentially leading to unauthorized data access.

Risk Assessment

Risk of unauthorized access to transferred data or man-in-the-middle attacks.

Recommendation

Update the FTP server to a patched version and configure IP restrictions for data connections.

Other vulnerabilities in FTP

CVE-1999-0083Medium
A file descriptor leak in the getcwd() function in FTP has been detected, which may lead to the disclosure of directory path information.

Original NVD description (English source)

FTP Passive Data Connection Not Bound to the Authenticated Control Peer

Vulnerability data from NVD (NIST) · CISA KEV · EPSS