CVE-2026-67193 describes an information disclosure vulnerability in Xlight FTP Server before version 3.9.5. An unauthenticated attacker can send a USER command with a username ending in ':adm' to trigger the admin protocol path within the FTP listener before authentication completes. This causes the server to leak its current GetTickCount() value via the FTP 331 response, exposing timing information that could be used for further analysis or attacks. The vulnerability does not require additional ports or configuration changes to exploit.

The vulnerability allows unauthenticated attackers to obtain timing information from the server, specifically the current GetTickCount() value. This constitutes an information disclosure that could potentially aid attackers in reconnaissance or timing-based attacks. There is no indication of direct code execution or privilege escalation from this vulnerability alone.

No official patch or remediation is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, consider restricting access to the FTP service or implementing network-level controls to limit exposure. Avoid using usernames ending with ':adm' if possible, as this triggers the vulnerability.