Listen to this Post
CVE-2026-49172 is a heap-based buffer overflow vulnerability in the Microsoft Windows FTP Service that allows an unauthenticated remote attacker to execute arbitrary code on affected systems. The flaw resides in how the FTP service handles certain network requests, specifically when parsing attacker-controlled data that exceeds the bounds of allocated heap memory. This memory corruption can overwrite adjacent heap metadata or critical function pointers, leading to control-flow hijacking and full system compromise.
The vulnerability is triggered over the network by sending specially crafted FTP commands or payloads to a target system running the vulnerable service. No authentication is required, and no user interaction is needed, making it highly dangerous for internet-exposed FTP servers. The attack complexity is low, meaning that an attacker can reliably exploit this flaw without needing advanced knowledge of the target environment.
At the protocol level, the exact FTP command or sequence that triggers the overflow has not been publicly disclosed by Microsoft. However, based on the CWE-122 classification, the service fails to properly validate the length or content of input data before copying it into a fixed-size heap buffer. This allows an attacker to write beyond the buffer’s boundaries, corrupting adjacent memory structures. In typical heap overflow exploits, this corruption can be leveraged to overwrite a function pointer or an exception handler, redirecting execution to attacker-supplied shellcode.
The affected component is the Windows FTP Service, which is an optional role service under Internet Information Services (IIS). It is not installed by default on client editions of Windows but is commonly enabled on Windows Server editions for file transfer purposes. Systems with the FTP Server role installed and the service running are at risk, especially if TCP port 21 is exposed to untrusted networks.
Microsoft patched this vulnerability on July 14, 2026, as part of its monthly security update release. The update addresses the overflow by introducing proper bounds checking and input validation in the FTP service’s parsing routines. Administrators are strongly urged to apply the relevant KB updates for their Windows version immediately. In the absence of a patch, mitigation measures include disabling the FTP service, blocking port 21 at the firewall, or restricting access to trusted IP addresses only.
The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) due to its network attack vector, low complexity, no privileges required, no user interaction, and the potential for complete compromise of confidentiality, integrity, and availability. Despite this score, Microsoft internally rated the issue as “Important” rather than “Critical,” citing the optional nature of the FTP service. However, the ZDI and other security researchers have highlighted the severity of a 9.8-rated RCE flaw that requires no authentication. As of the publication date, there is no evidence of active exploitation in the wild, and no public exploit code has been released, but the technical feasibility of exploitation is high.
DailyCVE Form:
Platform: Windows
Version: 10,11,Server 2019-2025
Vulnerability: Heap-based Buffer Overflow
Severity: 9.8 Critical
date: 2026-07-14
Prediction: 2026-07-14 (Patched)
What Undercode Say: Analytics
To identify systems running the vulnerable FTP service, administrators can use the following PowerShell command to check for installed IIS FTP components:
Get-WindowsFeature Web-Ftp-Server, Web-Ftp-Service, Web-Ftp-Ext
For a more thorough assessment, verify if the FTP service is actively listening and reachable:
Get-Service -Name FTPSVC | Select-Object Status, StartType netstat -an | findstr ":21 "
Nessus and other vulnerability scanners can detect this flaw by checking the Windows version and patch level. The Tenable plugin ID for this CVE is 326855, and it relies on the self-reported version number to determine exposure. A sample scan command using `nmap` to detect open FTP ports:
nmap -p21 --open <target_ip>
If the service is exposed, consider the following `iptables` rule to block external access (Linux-based firewall example):
iptables -A INPUT -p tcp --dport 21 -j DROP
For Windows Firewall, use:
New-NetFirewallRule -DisplayName "Block FTP" -Direction Inbound -LocalPort 21 -Protocol TCP -Action Block
Exploit:
The exploitation of CVE-2026-49172 involves sending a malicious FTP request containing a payload that exceeds the expected buffer size. A simplified conceptual example in Python (for educational purposes only) might look like:
import socket target = "192.168.1.100" port = 21 payload = b"A" 1024 Overflow data Actual exploit would require precise offset and shellcode s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target, port)) s.send(b"USER " + payload + b"\r\n") s.close()
In a real attack, the overflow would be carefully crafted to overwrite a return address or function pointer to redirect execution to attacker-controlled shellcode, often using a ROP chain to bypass exploit mitigations like DEP and ASLR. The specific command and offset are not publicly known, but the vulnerability is considered automatable and technically impactful.
Protection:
The primary protection is to apply the official Microsoft security update released on July 14, 2026. The relevant KB numbers vary by Windows version:
– Windows 11 Version 23H2: KB5099414
– Windows 10 Version 22H2: KB5099539
– Windows Server 2022: KB5099540
– Windows 11 Version 24H2: KB5101650
If patching is not immediately possible, disable the Windows FTP Service entirely:
Stop-Service FTPSVC Set-Service FTPSVC -StartupType Disabled
Alternatively, restrict access to the FTP service using firewall rules to allow only trusted IP addresses, and consider migrating to SFTP or FTPS with strong authentication if the service must remain operational. Network segmentation and intrusion detection systems (IDS) can also help detect and block exploit attempts.
Impact:
Successful exploitation of CVE-2026-49172 allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the FTP service, which typically runs as SYSTEM or a high-privileged account on Windows Server. This leads to a complete compromise of the target system, including:
– Confidentiality: The attacker can read sensitive files, credentials, and configuration data.
– Integrity: The attacker can modify, delete, or corrupt data, install backdoors, or alter system settings.
– Availability: The attacker can crash the service or the entire system, leading to denial of service.
The vulnerability poses a significant risk to organizations that rely on Windows FTP servers for file transfers, especially those exposed to the internet or untrusted networks. Even internal systems are at risk if an attacker gains a foothold elsewhere in the network and can pivot to the FTP server. Given the CVSS score of 9.8, this flaw should be treated as a critical priority for remediation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
