CVE-2021-36370: Midnight-Commander Midnight Commander

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.

Affected products

• Midnight-Commander Midnight Commander: up to and including 4.8.26

Published 2021-08-30. Last modified 2026-06-17.