Vendor
CrushFTP
As of , 3 CrushFTP vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 0 were added in 2026. Patch first: CVE-2024-4040.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2024-4040VFS Sandbox Escape | CrushFTP CrushFTP | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 2 | CVE-2025-54309Unprotected Alternate Channel | CrushFTP CrushFTP | Patch this weekEPSS 0.95 | 0.95 | ||
| 3 | CVE-2025-31161Authentication Bypass | CrushFTP CrushFTP | Patch this weekRansomware use; EPSS 0.99 | 0.99 |
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2024 | 1 |
| 2025 | 2 |
| 2026 | none |