Critical CVSS 10 RCE Vulnerability in Wing FTP Server Exploited Within 24 Hours

TL;DR

Security researchers at Huntress observed the exploitation of a severe CVSS 10.0 remote code execution (RCE) vulnerability in Wing FTP Server within 24 hours of its disclosure. Despite this, the damage was minimal due to inexperienced attackers making rookie errors, such as searching for basic command usage during the attack.

Critical Vulnerability in Wing FTP Server Exploited Within 24 Hours

Security researchers at Huntress observed the exploitation of a severe CVSS 10.0 remote code execution (RCE) vulnerability in Wing FTP Server on July 1, just one day after its public disclosure¹.

Rookie Errors by Attackers

Despite the critical nature of the vulnerability, the impact was minimized due to the inexperience of the attackers. Notably, the intruders were observed searching for basic information, such as how to use curl, midway through their attack. This lack of proficiency significantly limited the potential damage.

Implications and Mitigation

The swift exploitation of this vulnerability underscores the importance of prompt patching and vigilant monitoring. Organizations using Wing FTP Server are strongly advised to apply the latest security updates to mitigate the risk associated with this RCE flaw.

For more details, visit the full article: source.

Conclusion

The rapid exploitation of the CVSS 10.0 RCE vulnerability in Wing FTP Server highlights the urgent need for proactive security measures. While the inexperience of the attackers limited the damage in this instance, organizations must remain vigilant and promptly address such critical vulnerabilities to safeguard their systems.

References

1. (July 11, 2025). “CVSS 10 RCE in Wing FTP exploited within 24 hours, security researchers warn”. Retrieved July 11, 2025. ↩︎