CrushFTP Zero-Day Lets Attackers Bypass Authentication and Gain Admin Access
Active Exploitation · 2 sources · Updated 3mo ago · First seen Jul 22, 2025
A critical CrushFTP zero-day, tracked as CVE-2025-54309, has been reported as actively exploited in the wild, prompting urgent warnings from security researchers and national incident responders. The flaw affects CrushFTP 11.x and 10.x builds including 11.3.4_23 and later and 10.8.5 and later, and can allow attackers to bypass authentication and obtain administrator access over HTTPS when the DMZ proxy service is disabled. The issue has been assigned a CVSS 3.1 score of 9.0 and has been linked to improper AS2 validation in vulnerable versions.
CrushFTP released fixes in 11.3.4_26 and 10.8.5_12, and defenders were urged to patch immediately or restore the application’s original configuration from clean backups created on or before July 16 if patching is not yet possible. Reported indicators of compromise include changes to MainUsers/default/user.xml containing the string last_logins, creation of unknown administrator accounts with long identifiers, unusual UI behavior, administrator logins from unfamiliar IP addresses, and altered permissions on sensitive directories.
