Exploited vulnerability · CISA KEV

Is CVE-2025-47812 exploited? Yes: in CISA KEV since 14 Jul 2025

Gociux · Wing FTP Server · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2025-47812, Wing FTP Server Improper Neutralization of Null Byte or NUL Character Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 14 Jul 2025, 4 days after it was published. It affects Wing FTP Server. If you run it, CISA's required action is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What it is

Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default).

What to do

1. Check whether you run it. Look for Wing FTP Server in your asset inventory, including appliances and cloud images. Stack check lists every exploited Wing FTP Server CVE at once.
2. Apply the fix. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 10 Jul 2025.
4. Get told next time. Email alerts when CISA adds a CVE for Wing FTP Server.

Other exploited CVEs in Wing FTP Server

• CVE-2025-47813: Wing FTP Server Information Disclosure Vulnerability (16 Mar 2026)

References

• www.wftpserver.com/serverhistory.htm
• nvd.nist.gov/vuln/detail/CVE-2025-47812

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in July 2025 · Wing FTP Server scorecard · act-now radar.