Loading story…
Attackers are actively exploiting Wing FTP Server vulnerability CVE-2025-47812, a critical remote code execution flaw affecting versions prior to 7.4.4 on Windows, Linux, and macOS. The bug stems from improper null-byte handling in the username parameter of the loginok.html web interface, allowing unauthenticated or anonymous attackers to inject malicious Lua code into session files and trigger execution when the application processes that data, resulting in root access on Linux or NT AUTHORITY\SYSTEM on Windows.
Incident reporting shows exploitation began shortly after public disclosure, with attackers probing exposed servers, running reconnaissance commands, creating local user accounts for persistence, attempting payload delivery with certutil, using cURL for possible data exfiltration, and trying to deploy ScreenConnect through malicious Lua files. In one observed case, Microsoft Defender blocked a downloaded payload as Trojan:Win32/Ceprolad.A, and the affected WFTPServer.exe process later crashed before the host was isolated. Defenders are being urged to upgrade immediately to 7.4.4 or later and review session .lua files, session directories, and domain logs for signs of compromise.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Wing FTP developers released security updates addressing CVE-2025-47812, a critical remote code execution flaw affecting versions earlier than 7.4.4. The vulnerability stems from improper null-byte handling in the web interface's username parameter, enabling Lua injection and command execution.
On 2025-07-01, Huntress observed attackers exploiting CVE-2025-47812 in a customer environment, one day after the vulnerability's public disclosure. The intrusion involved probing from multiple IPs, reconnaissance commands, persistence via local user creation, and attempted payload delivery including a ScreenConnect installer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** added **Wing FTP Server** vulnerability `CVE-2025-47813` to its **Known Exploited Vulnerabilities (KEV)** catalog, warning that the flaw is being actively exploited and requiring Federal Civilian Executive Branch agencies to remediate it by **March 30, 2026** under **BOD 22-01**. The issue affects Wing FTP Server versions prior to **7.4.4** and stems from improper handling of an overly long `UID` cookie in `loginok.html`, which can cause the server to disclose the application's full local installation path during web authentication. Although `CVE-2025-47813` is an **information disclosure** issue rather than a standalone remote code execution bug, reporting indicates it can support attacker reconnaissance and may be chained with other Wing FTP Server flaws in broader attack paths. The vendor patched the vulnerability in **May 2025** in version **7.4.4**, alongside **`CVE-2025-47812`** and **`CVE-2025-27889`**, and researcher **Julien Ahrens** previously published proof-of-concept details showing how the path disclosure could aid exploitation. Organizations using Wing FTP Server, not just federal agencies, should verify they are no longer running vulnerable versions and review exposure of web-based authentication components.
Jun 29, 2026
A critical Windows Netlogon remote code execution flaw, tracked as **`CVE-2026-41089`**, is being actively exploited against corporate networks, with attacks targeting Windows Server domain controllers. The vulnerability can be triggered through specially crafted Netlogon requests without authentication or user interaction, potentially allowing attackers to run arbitrary code with **SYSTEM-level privileges** and escalate to full domain compromise. Microsoft patched the issue in its May 2026 Patch Tuesday release, which addressed **118 vulnerabilities**, including **16 critical** flaws, and the **Centre for Cybersecurity Belgium** flagged the Netlogon bug as a priority because of confirmed in-the-wild exploitation. Organizations are being urged to immediately patch supported Windows Server versions from 2012 onward, restrict domain controllers from untrusted network exposure, and increase monitoring for suspicious Netlogon and authentication activity while reinforcing segmentation and access controls around domain controllers.
Jun 30, 2026
Microsoft Windows Server Update Services (WSUS) is affected by **CVE-2025-59287**, a critical unauthenticated remote code execution flaw with a **CVSS 9.8** score that is being actively exploited in the wild. The vulnerability stems from insecure deserialization of `AuthorizationCookie` objects handled by the `GetCookie()` endpoint, allowing a remote attacker to send crafted `POST` requests to WSUS servers exposed on ports `8530` and `8531` and execute arbitrary code as **SYSTEM**. Observed exploitation has involved WSUS-related processes such as `w3wp.exe` and `wsusservice.exe` spawning `cmd.exe` and `powershell.exe`, indicating full server compromise through the update management service. Microsoft has issued an emergency security update for affected WSUS deployments, while defenders have been urged to patch immediately, restart servers after applying fixes, and restrict inbound access to ports `8530` and `8531` or disable WSUS temporarily if patching cannot be completed at once.
Aug 31, 2026