CVE-2026-67193 describes an information disclosure vulnerability in Xlight FTP Server prior to version 3.9.5. An unauthenticated attacker can send a specially crafted USER command with a username ending in ':adm' to trigger the admin protocol path within the standard FTP listener before authentication. This causes the server to leak its current GetTickCount() value via the FTP 331 response, exposing timing information. This leakage occurs without requiring separate ports or configuration changes.

The vulnerability allows unauthenticated attackers to obtain timing information from the server's internal GetTickCount() value. While this does not directly lead to code execution or privilege escalation, it may aid attackers in further reconnaissance or timing-based attacks. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, consider monitoring for suspicious USER commands with the ':adm' suffix and restrict access to the FTP server where possible.