Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

CrushFTP: actively exploited vulnerabilities

3 vulnerabilities in CrushFTP products (CrushFTP) are in CISA’s catalog of exploited vulnerabilities. Last added: July 22, 2025.

By category

Add just one CrushFTP category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • CrushFTP 3 vulnerabilities · File transfer (MFT)

Name used by CISA: CrushFTP. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this CrushFTP list.

  1. Rank 1CrushFTP

    CVE-2024-4040

    CrushFTP VFS Sandbox Escape Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Apr 24, 2024
    CISA deadline
    7 days
    CVSS severity
    10.0 (critical)

  2. Rank 2CrushFTP

    CVE-2025-54309

    CrushFTP Unprotected Alternate Channel Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Jul 22, 2025
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 3CrushFTP

    CVE-2025-31161

    Ransomware

    CrushFTP Authentication Bypass Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Apr 7, 2025
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

Follow and verify

Indicative classification, based on the vendor and product names given by CISA. How products are classified.