Is CVE-2026-63090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63090 being exploited in the wild.

How severe is CVE-2026-63090?

High severity, with a CVSS score of 8.8, published 20 July 2026.

Which products and versions are affected?

ProFTPD ProFTPD = 1.3.10rc1 < 1.3.10rc3.

Is there a fix for CVE-2026-63090?

A patch was published on 2026-07-07: Version 1.3.10rc3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63090 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63090?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63090: ProFTPD heap overflow in mod_sftp

Q: Is there a fix for CVE-2026-63090?

A patch was published on 2026-07-07: Version 1.3.10rc3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-63090 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-63090?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63090 · Severity: high · CVSS 8.8 · Published 2026-07-20

ProFTPD is a widely used file transfer server. A security flaw in its SFTP module allows a user with valid login credentials to crash the server or take full control of the underlying system. This could lead to unauthorized access to sensitive files, data theft, or a complete service outage.

Quick answers

Is CVE-2026-63090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63090 being exploited in the wild.
How severe is CVE-2026-63090?: High severity, with a CVSS score of 8.8, published 20 July 2026.
Which products and versions are affected?: ProFTPD ProFTPD < 1.3.9c, >= 1.3.10rc1 < 1.3.10rc3.
Is there a fix for CVE-2026-63090?: A patch was published on 2026-07-07: Version 1.3.10rc3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63090 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63090?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the mod_sftp module of ProFTPD within the fxp.c component. The vulnerability is caused by an incorrectly conditioned reallocation logic when reassembling fragmented SFTP packets that exceed the 16 KB buffer. An authenticated attacker can send oversized fragments to trigger this flaw, leading to pool freelist metadata corruption. By overwriting the root_fs BSS global pointer to point to a malicious filesystem structure, an attacker can redirect pr_fsio_stat() calls to system(), resulting in arbitrary code execution. The issue is fixed in versions 1.3.9c and 1.3.10rc3.

Affected products

ProFTPD ProFTPD < 1.3.9c, >= 1.3.10rc1 < 1.3.10rc3

Timeline

2026-06-26: disclosed: Issue reported by Fabian Wahle of Hap Security
2026-07-07: patched: Version 1.3.10rc3 released
2026-07-08: patched: Version 1.3.9c released
2026-07-20: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.