Loading story…
CISA added Wing FTP Server vulnerability CVE-2025-47813 to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaw is being actively exploited and requiring Federal Civilian Executive Branch agencies to remediate it by March 30, 2026 under BOD 22-01. The issue affects Wing FTP Server versions prior to 7.4.4 and stems from improper handling of an overly long UID cookie in loginok.html, which can cause the server to disclose the application's full local installation path during web authentication.
Although CVE-2025-47813 is an information disclosure issue rather than a standalone remote code execution bug, reporting indicates it can support attacker reconnaissance and may be chained with other Wing FTP Server flaws in broader attack paths. The vendor patched the vulnerability in May 2025 in version 7.4.4, alongside CVE-2025-47812 and CVE-2025-27889, and researcher Julien Ahrens previously published proof-of-concept details showing how the path disclosure could aid exploitation. Organizations using Wing FTP Server, not just federal agencies, should verify they are no longer running vulnerable versions and review exposure of web-based authentication components.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, CISA required Federal Civilian Executive Branch agencies to patch or mitigate affected Wing FTP Server systems by 2026-03-30. CISA also urged private-sector organizations to prioritize remediation or stop using affected instances until mitigations are in place.
On 2026-03-16, CISA added Wing FTP Server flaw CVE-2025-47813 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The bug affects versions before 7.4.4 and can expose the application's full local installation path via a long UID cookie during web authentication.
By March 2026, attackers were observed exploiting CVE-2025-47813 in real-world attacks. Reporting cited use of the flaw for reconnaissance, downloading and executing malicious Lua files, and installing remote monitoring and management software.
In June 2025, security researcher Julien Ahrens published proof-of-concept code for CVE-2025-47813. He said the path disclosure flaw could be used in the same exploit chain as CVE-2025-47812.
In May 2025, Wing FTP Server released version 7.4.4 to fix CVE-2025-47813, CVE-2025-47812, and CVE-2025-27889. The fixes addressed an installation-path disclosure bug, a critical remote code execution flaw, and an information disclosure issue that could expose user passwords.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **Wing FTP Server** vulnerability `CVE-2025-47812`, a critical remote code execution flaw affecting versions prior to **7.4.4** on Windows, Linux, and macOS. The bug stems from improper null-byte handling in the `username` parameter of the `loginok.html` web interface, allowing unauthenticated or anonymous attackers to inject malicious **Lua** code into session files and trigger execution when the application processes that data, resulting in **root** access on Linux or **NT AUTHORITY\SYSTEM** on Windows. Incident reporting shows exploitation began shortly after public disclosure, with attackers probing exposed servers, running reconnaissance commands, creating local user accounts for persistence, attempting payload delivery with `certutil`, using `cURL` for possible data exfiltration, and trying to deploy **ScreenConnect** through malicious Lua files. In one observed case, Microsoft Defender blocked a downloaded payload as **`Trojan:Win32/Ceprolad.A`**, and the affected `WFTPServer.exe` process later crashed before the host was isolated. Defenders are being urged to upgrade immediately to **7.4.4** or later and review session `.lua` files, session directories, and domain logs for signs of compromise.
Jul 24, 2026
CISA has issued an alert regarding the active exploitation of two critical vulnerabilities: a local file inclusion/remote code execution (LFI/RCE) flaw in *Gladinet CentreStack* and *Triofox* (CVE-2025-11371), and an OS command injection vulnerability in *Control Web Panel* (CWP) (CVE-2025-48703). Both vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog following evidence of in-the-wild attacks, and are considered significant risks for organizations, especially those in the federal enterprise. Federal Civilian Executive Branch (FCEB) agencies are mandated by Binding Operational Directive (BOD) 22-01 to remediate these vulnerabilities by the specified due date to protect against ongoing threats. CISA strongly recommends that all organizations, not just federal agencies, prioritize patching these vulnerabilities as part of their vulnerability management practices to reduce exposure to cyberattacks leveraging these flaws.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities—CVE-2025-11371 in Gladinet CentreStack/Triofox and CVE-2025-48703 in Control Web Panel (CWP)—to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. CVE-2025-11371 is a local file inclusion flaw in Gladinet CentreStack and Triofox that allows unauthenticated access to system files, with reports from Huntress indicating that threat actors have already targeted at least three organizations by running reconnaissance commands via Base64-encoded payloads. CVE-2025-48703 is an unauthenticated remote code execution vulnerability in CWP, exploitable via shell metacharacters in the `t_total` parameter of a filemanager request, though there are currently no public reports of this flaw being weaponized in real-world attacks. CISA has mandated that Federal Civilian Executive Branch (FCEB) agencies apply the necessary patches by November 25, 2025, to mitigate these risks. Both Gladinet and Huntress have issued alerts and recommended workarounds for the actively exploited CentreStack/Triofox vulnerability, such as disabling the temp handler in the UploadDownloadProxy’s web configuration. The addition of these vulnerabilities to the KEV catalog underscores the urgency for organizations using these platforms to implement security updates and monitor for signs of exploitation, especially as technical details for the CWP flaw have been publicly disclosed, increasing the risk of future attacks.
Jun 29, 2026