Brand
CrushFTP: actively exploited vulnerabilities
3 vulnerabilities in CrushFTP products (CrushFTP) are in CISA’s catalog of exploited vulnerabilities. Last added: July 22, 2025.
-
0 vulnerabilities added in the last 12 months
-
3 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one CrushFTP category to your radar, or open its page.
- Managed file transfer (MFT) 3 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
- CrushFTP3 vulnerabilities, File transfer (MFT)
Name used by CISA: CrushFTP. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this CrushFTP list.
- Rank 1
CrushFTPCVE-2024-4040
CrushFTP VFS Sandbox Escape Vulnerability
CVSS severity 10.0critical
Added Apr 24, 2024
- Rank 2
CrushFTPCVE-2025-54309
CrushFTP Unprotected Alternate Channel Vulnerability
CVSS severity 9.8critical
Added Jul 22, 2025
- Rank 3
CrushFTPCVE-2025-31161
CrushFTP Authentication Bypass Vulnerability
Ransomware
CVSS severity 9.8critical
Added Apr 7, 2025
Follow and verify
Indicative classification, based on the vendor and product names given by CISA. How products are classified.