CISA Adds Wing FTP Server Flaw to KEV as RCE Chain Exploits Surge

CISA Flags Wing FTP Zero-Day Chain Now Being Exploited at Scale

CISA added CVE-2025-47813 to its Known Exploited Vulnerabilities (KEV) catalog on March 16, 2026, ordering U.S. government agencies to patch their Wing FTP Server deployments within two weeks.

The flaw — a seemingly routine medium-severity (CVSS 4.3) information disclosure vulnerability — is being exploited as the first step in a kill chain that ultimately delivers unauthenticated remote code execution via CVE-2025-47812 (CVSS 10.0 — Critical). Attackers exploiting both vulnerabilities together can compromise a Wing FTP Server host with SYSTEM or root privileges, no authentication required.

Attack Details

How the Chain Works

CVE-2025-47813 exploits improper error handling in Wing FTP's /loginok.html endpoint. A low-privileged attacker submits an overlong UID cookie value, causing the server to return a verbose error message that includes the full local installation path (e.g., C:\Program Files\WingFTP\).

Armed with that path, the attacker moves to CVE-2025-47812: a null byte injection flaw in the authentication handler. By inserting a null byte (%00) into the username parameter, the server writes attacker-controlled Lua code into a session file at the now-known filesystem path. When the server loads that session, the Lua payload executes with SYSTEM/root privileges.

Researcher Julien Ahrens of RCE Security documented the complete chain in June 2025 and published a working proof-of-concept. The first observed exploitation followed just 24 hours later.

Who Is Being Targeted

Huntress confirmed active exploitation on customer systems, with attacks originating from multiple distinct IP addresses — suggesting multiple threat actors are exploiting the chain, not a single targeted campaign.

Wing FTP Server claims over 10,000 customers worldwide, including organizations in government, aerospace, and media. Approximately 2,000 instances are internet-facing. Observed post-exploitation behavior includes:

• Creation of new local user accounts for persistence
• Download and execution of malicious batch files
• Deployment of ScreenConnect for persistent remote access

Impact Assessment

Recommendations

Immediate Actions

1. Upgrade to Wing FTP Server v7.4.4 immediately — both CVEs are resolved in this release
2. Inventory all deployments — include dev, staging, and shadow IT instances that may run unmanaged versions
3. Restrict internet exposure — if external access isn't required, place Wing FTP behind a VPN or firewall
4. Hunt for ScreenConnect on Wing FTP hosts that wasn't deliberately installed

For Security Operations

1. Review authentication logs for POST requests to /loginok.html with oversized cookie values
2. Check for null byte patterns (%00) in Wing FTP username logs
3. Rotate credentials on any affected host as a precaution
4. Treat any compromise as a full incident — ScreenConnect deployment indicates adversary persistence intent

Key Takeaways

1. The CVSS score of 4.3 is misleading — this flaw's real-world danger is as the entry point for a CVSS 10.0 exploit chain
2. Patches have been available since May 14, 2025 — any unpatched organization has had 10 months to act
3. Exploitation continues at scale 8+ months after disclosure, indicating a large unpatched population
4. Multiple threat actors are involved — this is not a targeted campaign but broad opportunistic exploitation
5. CISA's KEV addition reinforces urgency — federal agencies have two weeks; private sector should treat this with equal priority

Sources

• BleepingComputer — CISA flags Wing FTP Server flaw as actively exploited in attacks
• CISA — Known Exploited Vulnerabilities Catalog
• Huntress — Wing FTP Server RCE Exploited in the Wild
• RCE Security — CVE-2025-47812 Full Technical Write-Up
• NVD — CVE-2025-47813