CVE-2025-47812

Confirmed PUBLISHED

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into...

wftpserver · Wing FTP Server

1 day faster than CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

10.0 Critical EPSS 95.3%

At a Glance

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.

cisa nuclei_scanner

CVE Published: Jul 10, 2025
Exploitation Reported: Jun 01, 2026
CVSS: 10.0 Critical
EPSS: 95.3%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
wftpserver	Wing FTP Server	0 to < 7.4.4	Affected

CVE References

wftpserver.com wftpserver.com · CVE Record https://www.wftpserver.com
rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cv... rcesecurity.com · CVE Record https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce...
vicarius.io/vsociety/posts/cve-2025-47812-mitigation-scr... vicarius.io · CVE Record https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-scri...
vicarius.io/vsociety/posts/cve-2025-47812-detection-scri... vicarius.io · CVE Record https://www.vicarius.io/vsociety/posts/cve-2025-47812-detection-scrip...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2026-06-01 10:36 UTC
CISA	2026-06-02 14:07 UTC
Daily CyberSecurity	2026-06-09 07:20 UTC
The Shadowserver	2026-07-08 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47812.yaml	Jun 01, 2026

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-06-01 10:36:56 UTC · CVE

Proof of concept available

Recorded 2026-06-12 14:21:07 UTC · Nuclei Templates

Weaknesses (CWE)

CWE-158

Improper Neutralization of Null Byte or NUL Character

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-47812.yaml	Jun 01, 2026

Recent Mentions

Cisco ISE Vulnerabilities: Critical RCE and Info Disclosure Flaws

Daily CyberSecurity · Jun 17, 2026

Network administrators must remain vigilant as new Cisco ISE vulnerabilities have been publicly disclosed. Multiple severe flaws The post Cisco ISE Vulnerabilities: Critical RCE and Info Disclosure Flaws appeared first on Daily CyberSecurity. Related posts: Urgent: Cisco ISE Flaws (CVSS 10.0) Actively Exploited in the Wild – Patch Immediately! Critical Wing FTP Server RCE (CVE-2025-47812) Actively Exploited In The Wild Critical 9.4 CVSS Zephyr RTOS Flaw Exposes Millions of IoT Devices to RCE

Important Apache CXF Vulnerabilities Demand Immediate Action

Daily CyberSecurity · Jun 13, 2026

Recently, security researchers disclosed several important Apache CXF vulnerabilities. This popular open-source services framework helps developers build robust The post Important Apache CXF Vulnerabilities Demand Immediate Action appeared first on Daily CyberSecurity. Related posts: CVE-2025-58782: Apache Jackrabbit Vulnerability Exposes Systems to JNDI Injection and RCE Critical Wing FTP Server RCE (CVE-2025-47812) Actively Exploited In The Wild Broadcom Addresses Critical Vulnerabilities in VMware ESXi, Workstation, and Fusion

New Patches Secure Critical Spring HATEOAS Flaws

Daily CyberSecurity · Jun 12, 2026

Two Severe Vulnerabilities Discovered Developers must act now to secure Java apps. The team found critical Spring HATEOAS The post New Patches Secure Critical Spring HATEOAS Flaws appeared first on Daily CyberSecurity. Related posts: Critical Wing FTP Server RCE (CVE-2025-47812) Actively Exploited In The Wild Broadcom Addresses Critical Vulnerabilities in VMware ESXi, Workstation, and Fusion Critical 9.4 CVSS Zephyr RTOS Flaw Exposes Millions of IoT Devices to RCE

Critical Veeam Backup Vulnerability Exposed

Daily CyberSecurity · Jun 10, 2026

A critical Veeam Backup vulnerability threatens enterprise backup servers running older software versions. This severe flaw allows authenticated The post Critical Veeam Backup Vulnerability Exposed appeared first on Daily CyberSecurity. Related posts: CVE-2025-6218: WinRAR Directory Traversal Bug Opens the Door to Remote Code Execution SAP’s July 2025 Patch Day Brings 27 New Notes, Multiple Critical RCE & Deserialization Flaws (CVSS 10.0) Critical Wing FTP Server RCE (CVE-2025-47812) Actively Exploited In The Wild

SAP Security Patch Day: Critical Security Vulnerabilities Remediated

Daily CyberSecurity · Jun 09, 2026

Large-Scale Updates Protect Enterprise Infrastructure Assets The security team managing the enterprise resource planning ecosystem released vital administrative The post SAP Security Patch Day: Critical Security Vulnerabilities Remediated appeared first on Daily CyberSecurity. Related posts: The Silent Leak: Critical 9.1 CVSS Spring Security Flaw Strips Away Vital HTTP Headers Critical Wing FTP Server RCE (CVE-2025-47812) Actively Exploited In The Wild Broadcom Addresses Critical Vulnerabilities in VMware ESXi, Workstation, and Fusion

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Wing FTP Server <= 7.4.3 - Remote Code Execution

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

8 Jul 2026 00:00 UTC 10 days ago

8 Jul 2026 00:00 UTC · 10 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
12 Jun 2026 14:21 UTC about 1 month ago

12 Jun 2026 14:21 UTC · about 1 month ago

Public PoC available

Public proof-of-concept code published
9 Jun 2026 07:20 UTC about 1 month ago

9 Jun 2026 07:20 UTC · about 1 month ago

KEV confirmed by Daily CyberSecurity

Exploitation attested by an external source
2 Jun 2026 14:07 UTC about 2 months ago

2 Jun 2026 14:07 UTC · about 2 months ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
1 Jun 2026 15:34 UTC about 2 months ago

1 Jun 2026 15:34 UTC · about 2 months ago

Nuclei template available

Scanner coverage available
1 Jun 2026 10:36 UTC about 2 months ago

1 Jun 2026 10:36 UTC · about 2 months ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
10 Jul 2025 00:00 UTC about 1 year ago

10 Jul 2025 00:00 UTC · about 1 year ago

CVE published

Vulnerability disclosed publicly
10 May 2025 00:00 UTC about 1 year ago

10 May 2025 00:00 UTC · about 1 year ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2025-47812

{
  "cve_id": "CVE-2025-47812",
  "title": "In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle ...",
  "affected_vendor": "wftpserver",
  "affected_product": "Wing FTP Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "epss_score": 0.95343,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2025-47812

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API