Back Securityaffairs.Co

U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog

Securityaffairs.Co •Pierluigi Paganini • March 16, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Wing FTP Server flaw, tracked as CVE-2025-47813 (CVSS score of 4.3), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2025-47813 is an information disclosure vulnerability affecting Wing FTP […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Alerts on Actively Exploited Wing FTP Server Vulnerability CVE-2025-47813 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned about an actively exploited vulnerability in Wing FTP Server, tracked as CVE-2025-47813. This flaw allows attackers to disclose the local installation path of the application by using a long value in the UID cookie, posing a medium risk (CVSS 4.3). CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on March 16, 2026, urging all users, especially federal agencies, to secure their systems. The vulnerability is part of a series of flaws, including the critical CVE-2025-47812, which allows remote code execution without requiring login. The affected versions are those prior to 7.4.4, released in May 2025. Cybercriminals are actively targeting data transfer software, increasing the urgency for organizations to patch their systems. The developer has since released version 8.1.2, which addresses these vulnerabilities. CISA's advisory highlights the ongoing risks associated with outdated software in the cybersecurity landscape. 8 sources 61

Extracted Entities

CVEs (1)

CVE-2025-47813

Platforms (1)

Wing FTP Server