008

A critical RCE (CVE-2025-47812, CVSS 10.0) in Wing FTP Server allows null-byte Lua injection via the username/login handling, enabling remote execution as root/SYSTEM; active exploitation was observed immediately after disclosure, with threat actors performing reconnaissance, creating accounts, and dropping Lua files to stage a ScreenConnect installer. Users are urged to upgrade to Wing FTP Server 7.4.4 or later; CISA added the vulnerability to its KEV catalog with mandated remediation timelines.