Cerberus FTP Server by Cerberus: insecure inherited permissions enable local privilege escalation

Insecure preserved inherited permissions vulnerability in Cerberus FTP Server on Windows allows Privilege Escalation.This issue has been resolved in Cerberus FTP Server: 2026.1

• On Windows, the normalized record marks Cerberus FTP Server as affected in a custom range beginning at 0 and ending at 2025.4.2.
• Cerberus FTP Server 2026.1 is marked unaffected, and the vendor release notes identify that release as fixing the local privilege escalation involving BUILTIN\Users write access to the update-installer directory.
• The available evidence does not establish the status of every release branch after 2026.1 or of parallel branches. Do not infer an open-ended range of unaffected releases from 2026.1.

This is a CWE-278 weakness in which inherited Windows permissions allow a low-privileged local user to write to the location used for update installers. Cerberus stores configuration, logs, and other service data under C:\ProgramData\Cerberus LLC\Cerberus FTP Server; the advisory found that this directory inherited permissions from C:\ProgramData\ and allowed BUILTIN\Users to create files and directories. The update feature downloaded an installer into the ...\installers directory using a predictable name matching CerberusUpdate_amd64_<version>.exe. A low-privileged local user could pre-create a same-named executable and retain control of it when the updater later overwrote the file. When an administrator initiated the update, the update function ran with local administrator privileges, so the substituted executable could run with those privileges. It remains unconfirmed whether every deployment has the same inherited ACLs, because customized permissions may change the exposure.

The concrete advisory mechanism is local: the attacker needs a low-privileged account on the Windows host and the ability to write to the update-installer location. The described path also requires an administrator to initiate the update, making that administrative action a precondition. The condition involves replacing a file during the update process, and the advisory documents a public proof of concept. The supplied record does not establish exploitation in the wild or ransomware use. A secondary scoring record describes network reachability, but that conflicts with the local mechanism in the advisory and the CNA's local-vector assessment; the concrete advisory should guide the operational description.

Successful exploitation could execute attacker-controlled code with local administrator privileges on the Cerberus host. Consequences could include loss of confidentiality, integrity, and availability on that host, including unauthorized changes to configuration, files, or service operations. The described path is local to the host; the evidence does not establish SYSTEM privileges, remote exploitation, domain compromise, or lateral movement. Because an administrator must initiate the update, systems that do not expose the update location to untrusted local users may have lower practical exposure, but that is not a substitute for patching.

A successful attack can give a local user local-administrator execution on the Cerberus host. That access could allow unauthorized changes to server configuration and files, exposure of data handled by the service, or disruption of file-transfer operations. The practical consequence depends on the accounts, data, and services present on the affected host. The available evidence does not establish compromise of other hosts, a domain, or the wider enterprise environment.

1. Upgrade affected Windows installations to Cerberus FTP Server 2026.1, the exact release marked unaffected and identified by the vendor as containing the fix.
2. Do not treat 2026.1 as proof that every later or parallel branch is covered. If selecting another branch, verify that branch's security status and vendor support.
3. Until the upgrade is completed, restrict untrusted local users from writing to C:\ProgramData\Cerberus LLC\Cerberus FTP Server\installers and review ACL changes. This is a precaution based on the described attack condition, not a replacement for the confirmed fix.
4. If exploitation is suspected, preserve files and telemetry associated with the installer directory before removal or recovery. The advisory does not provide another confirmed interim mitigation.

1. Inventory Windows hosts running Cerberus FTP Server and compare each installed version with the affected and fixed boundaries in affected_summary.
2. Inspect the ACL on C:\ProgramData\Cerberus LLC\Cerberus FTP Server\installers, especially whether BUILTIN\Users or other untrusted local principals can create or write files.
3. Review unexpected executable files in that directory, including files matching the update naming pattern CerberusUpdate_amd64_<version>.exe. This naming pattern is an investigation lead, not an independently confirmed IOC.
4. Correlate endpoint telemetry for file creation, replacement, or execution in the installer directory with administrator-initiated updates. This is precautionary monitoring, not a vendor-confirmed indicator.
5. If suspicious activity is found, preserve relevant file metadata, ownership information, and endpoint evidence before cleanup. The absence of matching telemetry does not prove that a system is safe.