CISA adds Wing FTP vulnerability to the KEV list

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added a new security vulnerability to its Known Exploited Vulnerabilities (KEV) list , raising concerns about the Wing FTP Server software . The decision was based on evidence that the vulnerability is already being actively exploited by attackers online , raising the severity rating despite its relatively low rating.

Technical characteristics of vulnerability CVE-2025-47813

The vulnerability, which has been recorded as CVE-2025-47813 and carries a CVSS score of 4.3, is related to sensitive information leakage. Specifically, it allows the disclosure of the application installation path under certain conditions. The problem is located in the way the server handles error messages, particularly when unexpected or excessively large values ​​are used in the UID cookie.

See also: OpenClaw AI Agent: Critical vulnerabilities allow prompt injection

According to CISA, insufficient validation of this data leads to the generation of error messages that may reveal critical information about the system structure. While the vulnerability is not considered catastrophic in itself, it can act as a tool reconnaissance for more complex attacks.

Wing FTP Server: Affected versions and available fix

The issue affects all versions of Wing FTP Server up to and including version 7.4.3. The company resolved the issue with version 7.4.4, which was released in May after security researcher Julien Ahrens. This update is considered critical because it does not just fix the vulnerability.

Critical remote code execution flaw

Of particular importance is the fact that the same release also fixes CVE-2025-47812, an extremely serious security flaw with a CVSS score of 10.0. This particular bug allows Remote Code Execution (RCE), allowing attackers to gain complete control of the system.

Since July 2025, there have been incidents of active exploitation of this vulnerability, reinforcing the need for immediate system upgrades. These attacks are often part of broader cyberespionage or malware deployment campaigns.

See also: CrackArmor: 9 vulnerabilities in Linux AppArmor allow root escalation

Real attacks and attacker tactics

According to analysis by Huntress, attackers have already exploited this critical flaw to download and execute malicious Lua files. At the same time, they are conducting reconnaissance of the system, collecting information that allows them to move more effectively within the network.

In many cases, attackers install remote administration toolsthat give them constant access to infected systems. This tactic is often used to persist on the network for long periods of time and further exploit infrastructure.

How the exploitation of the vulnerability works

Julien Ahrens presented a proof-of-concept exploit, revealing that the endpoint “/loginok.html” does not properly validate the UID cookie value (resulting in revealing the full server path).

This information can be used by an attacker to design more targeted attacks, especially in combination with other vulnerabilities, such as remote code execution.

See also: SQLi vulnerability in Ally plugin affects 250k+ WordPress sites

Recommendations and next steps for organizations

While full details of how the vulnerability could be exploited in real-world attacks have not been made public, its inclusion on the KEV list is a clear indication that the threat exists. US federal agencies have been instructed to implement the necessary fixes by March 30, 2026.

For organizations and businesses using Wing FTP Server, an immediate upgrade to version 7.4.4 is considered imperative. In addition, it is recommended to continuously monitor systems for suspicious activity, as well as adopt security practices that limit the likelihood of successful exploitation of such vulnerabilities.