CVE-2026-49172

What it actually does

CVE-2026-49172 is a heap-based buffer overflow in the Windows FTP Service. A remote, unauthenticated attacker can send specially crafted FTP network traffic that causes memory corruption in the FTP service process. Because the vulnerability is network-accessible, requires low attack complexity, no credentials, and no user interaction, successful exploitation can result in remote code execution with the privileges of the FTP service, potentially enabling full compromise of the affected Windows host depending on service configuration and process privileges.

Why it matters to the business

Organizations running the Windows FTP Service on affected Windows client or server versions face a high-severity risk of remote system compromise, especially where FTP is exposed to internal networks, partner networks, or the internet. Successful exploitation could allow attackers to take control of file-transfer servers, steal or alter transferred data, deploy malware, disrupt business processes that depend on FTP workflows, or use the compromised host as a foothold for lateral movement. This issue is not currently listed in CISA KEV and has low EPSS at the time of assessment, but the CVSS 9.8 rating and unauthenticated network attack vector make exposed FTP services a priority for rapid remediation or isolation.

How an attack unfolds

An attacker first identifies systems with the Windows FTP Service reachable over the network, typically by scanning for FTP listeners on TCP port 21 or alternate configured FTP ports. The attacker then establishes an FTP connection and sends malformed protocol data designed to overflow a heap buffer in the service. If the crafted input successfully corrupts memory in a controlled way, the attacker can redirect execution flow and run arbitrary code in the FTP service process context. After code execution, the attacker may install tooling, create persistence, access files available to the service, harvest credentials or tokens present on the host, modify FTP content, disable security controls, and pivot to other systems. No public exploit maturity or known active exploitation was provided, so exploitation should be considered plausible for exposed services but not confirmed as commoditized from the supplied data.

How to fix it

Apply the relevant Microsoft security updates for affected Windows versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, or enterprise patch management. The affected product list includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so remediation should be validated against Microsoft’s official security update guidance for this CVE and each supported OS build. If immediate patching is not possible, disable the Windows FTP Service where it is not required, stop and disable Microsoft FTP-related services, remove the FTP Server role/service, restrict FTP exposure to trusted source IPs only, block inbound FTP at firewalls, and place any required FTP service behind VPN, segmentation, or application-layer inspection. Avoid exposing FTP directly to the internet and consider migrating business workflows to more secure managed file-transfer mechanisms such as SFTP or HTTPS-based transfer services.

How to confirm the fix worked

Confirm whether affected systems have the applicable Microsoft security update installed by checking Windows Update history, enterprise patch compliance reports, Microsoft Update Catalog package deployment, or OS build and cumulative update level against Microsoft’s advisory. Validate exposure by inventorying systems with the FTP Server role enabled and checking for listening FTP ports, especially TCP 21. On Windows servers, review installed IIS components and services for FTP Server/FTPSVC presence, and verify whether the service is stopped, disabled, or network-restricted where not required. Use network scanning from relevant trust zones to confirm FTP is not reachable except from approved sources. After remediation, perform a controlled service check to verify the FTP listener is patched, disabled, or inaccessible according to policy, and monitor for service crashes or abnormal behavior that could indicate failed exploit attempts.

Typical attack path

1. Scan networks for hosts exposing FTP services, commonly TCP port 21.
2. Fingerprint the service to identify Windows FTP Service on affected Windows versions.
3. Open an FTP session without needing valid credentials if the vulnerable code path is reachable pre-authentication.
4. Send specially crafted FTP commands or payload data that trigger the heap-based buffer overflow.
5. Achieve memory corruption and execute attacker-controlled code in the FTP service process context.
6. Establish persistence, stage additional malware, or create command-and-control connectivity.
7. Access, alter, or exfiltrate FTP-hosted files and use the compromised Windows host for lateral movement.

How to detect it

To determine whether exploitation has already occurred, review Windows FTP Service and IIS FTP logs for malformed, unusually long, or high-volume FTP commands, repeated connection attempts from unfamiliar sources, failed sessions immediately preceding service crashes, and activity against anonymous or pre-authentication paths. Examine Windows System and Application event logs for FTP service crashes, Windows Error Reporting events, application fault events, service restarts, or unexpected termination of FTP/IIS-related processes. Hunt for suspicious process creation where FTP/IIS service processes spawn command shells, scripting engines, download utilities, archive tools, or remote access tools. Review EDR telemetry for memory-corruption symptoms, exploit prevention alerts, or post-exploitation behavior on hosts running the FTP Server role. Inspect file integrity on FTP content directories for unexpected uploads, web shells or script files if FTP directories overlap with web roots, altered binaries, new scheduled tasks, new services, new local users, firewall rule changes, credential dumping activity, and outbound command-and-control connections. Because no public exploit maturity, named threat actors, or specific exploit strings were provided, detection should focus on behavioral evidence: abnormal FTP input, service instability, suspicious child processes, and post-compromise artifacts.

• TCP/21 open on Windows hosts running FTP service
• Service name: FTPSVC
• Process name: svchost.exe hosting FTPSVC
• Log path: C:\inetpub\logs\LogFiles\FTPSVC*
• Log path: C:\Windows\System32\LogFiles\FTPSVC*
• Event source: Microsoft-Windows-IIS-FTP
• Event source: Service Control Manager
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001
• Faulting application name: svchost.exe
• Faulting module name: ftpsvc.dll
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning pwsh.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• svchost.exe spawning cmd.exe
• svchost.exe spawning powershell.exe
• svchost.exe spawning certutil.exe
• svchost.exe spawning bitsadmin.exe

What your security team should do

• Immediately inventory all Windows systems running the Windows FTP Service, prioritizing internet-facing and partner-facing hosts.
• Patch affected Windows versions through approved Microsoft update channels and track completion by OS build and cumulative update level.
• Disable or remove the FTP Server role wherever business use is not explicitly required.
• Restrict inbound FTP access to approved source networks and block unsolicited external access at perimeter and host firewalls.
• Increase monitoring for FTP service crashes, abnormal FTP command patterns, suspicious child processes spawned from IIS/FTP service contexts, and new persistence artifacts on FTP servers.
• Review recent FTP server logs and Windows event logs for evidence of anomalous pre-authentication activity or unexpected service failures since publication.
• If exploitation is suspected, isolate the host, preserve volatile evidence, collect memory and relevant logs, rotate credentials that may have been exposed, and perform lateral movement hunting.
• Consider replacing legacy FTP workflows with encrypted and better-isolated file transfer solutions such as SFTP, FTPS with strict controls, or managed file-transfer platforms.