A critical zero-day flaw in CrushFTP that can grant attackers administrator access was discovered on July 18 and is under active exploitation.

CVE-2025-54309: CrushFTP Zero-Day Vulnerability Exploited In The Wild

CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

A zero-day vulnerability in CrushFTP is under active exploitation, granting remote attackers admin access. Patching is strongly advised as soon as possible.

CrushFTP versions prior to 10.8.5 and 11.x versions prior to 11.3.4_23 are vulnerable to a race condition that could allow an unauthenticated remote attacker to access unauthorized endpoints through a specially crafted request.

This issue is due to improper handling of concurrent requests. An attacker could exploit this issue by sending multiple requests in parallel to the affected application.

The CrushFTP application installed on the remote host is missing a vendor-supplied patch. It is, therefore, affected by a vulnerability. CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114950	CrushFTP < 10.8.5 / 11.x < 11.3.4_23 Race Condition	Web App Scanning	Component Vulnerability	Check Based	critical
242340	CrushFTP 10.x < 10.8.5 / 11.x < 11.3.4_23 Privilege Escalation (CVE-2025-54309)	Nessus	FTP	Local	critical

Detections

Analytics

CVE-2025-54309

critical

Tenable Plugins

critical

critical