Exposed services · FTP

Is an FTP server on port 21 a risk for my firm?

It can be.

Last read from the sources at the foot of this page.

Check my firm Read the steps
01

What is FTP?

File Transfer Protocol (FTP) moves files between computers. It listens on port 21 and is often left running on web hosts and office servers long after anyone uses it.

02

Why does it matter?

ProFTPD Improper Access Control Vulnerability 2026-10-08 ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

On 8 October 2026 CISA added a ProFTPD flaw from 2015 to its catalog of exploited flaws. CISA says the flaw could let remote attackers read and write any file through two FTP commands.

An FTP server often holds client documents or website files, so a flaw there reaches straight into your data.

03

What do I do about it?

  1. Ask whether anyone still uses FTP.If not, turn the service off on your server or web host.
  2. If file transfer is needed, use SFTP or a client portal with multi-factor sign-in.
  3. Update or remove old FTP server software such as ProFTPD.
  4. Remove the port forwarding rule for port 21 in your router or firewall.
Sources

Where does this come from?

Related
05 · Check my firm

See what is open before anyone else does.

We read from outside, find each way in first, and show it with a check anyone can re-run. No access, nothing tested, no obligation.

What we readPublic sources only
Who sees itYou alone
Delivery72 hours from confirmation
Meeting firstNone
Reading requestPrivate
Problem: Enter your firm's name.
Problem: Enter your name.
Problem: Enter a full address, like [email protected].
Problem: That does not look like a website. Try yourdomain.com.

A person reads every request. Your outside reading comes by email within 72 hours from [email protected]. Privacy