CVE-2026-102722: Eclipse Foundation Netx Duo

Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days.

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.

Affected products

• Eclipse Foundation Netx Duo: up to and including 6.5.1.202602

Published 2026-09-29. Last modified 2026-09-29.