Wing FTP Server Vulnerability - CISA Issues Urgent Warning

The Flaw

A critical vulnerability has been identified in Wing FTP Server, tracked as CVE-2025-47813. This flaw is categorized as an information disclosure vulnerability. The issue arises when the server processes specific web session data, particularly user identification parameters. When a malicious actor submits an excessively long string in the UID cookie, the server fails to handle this input properly. Instead of rejecting it, the server responds with a verbose error message that reveals sensitive system information.

This vulnerability falls under the CWE-209 classification, which highlights flaws where software generates error messages containing sensitive operational details. Such weaknesses can be exploited by attackers during the initial stages of a cyberattack, allowing them to gather crucial information about the target environment.

What's at Risk

The exploitation of this vulnerability poses significant risks, especially for organizations using Wing FTP Server for secure file transfers. Since file transfer servers are often located at the edge of corporate networks, they become attractive targets for hackers. By leaking sensitive operational data, attackers can map out the target's infrastructure, identify software versions, and discover potential entry points for deeper attacks.

CISA has confirmed that this vulnerability is actively being exploited in the wild, although the full scope and nature of the attacks are still under investigation. The urgency is heightened by the fact that information disclosure vulnerabilities are highly sought after by threat actors, especially during reconnaissance phases.

Patch Status

Under Binding Operational Directive (BOD) 22-01, federal civilian executive branch agencies are required to address this vulnerability by March 30, 2026. While this directive primarily applies to federal networks, CISA strongly encourages all private-sector organizations and critical infrastructure operators to prioritize this fix. Organizations must patch or mitigate all vulnerable instances of Wing FTP Server by the deadline.

System administrators are urged to consult official vendor instructions to apply necessary software updates immediately. If immediate patching is not feasible, organizations should temporarily cease using the affected software until proper mitigations can be implemented.

Immediate Actions

Organizations relying on Wing FTP Server must act swiftly to protect their data environments. Here are some recommended actions:

• Patch the software: Follow vendor guidelines to ensure the latest updates are applied.
• Monitor for suspicious activity: Keep an eye on logs for unusual access patterns that may indicate exploitation attempts.
• Educate staff: Ensure that all employees are aware of the potential risks associated with this vulnerability.

By taking these steps, organizations can significantly reduce their risk of falling victim to attacks exploiting this critical vulnerability. The time to act is now, as the window for attackers to exploit this flaw continues to close with each passing day.