CrushFTP Vulnerability Exploited in Attacks Following PoC Release

Security researchers and Shadowserver report active exploitation of a critical CrushFTP authentication bypass (CVE-2025-2825, CVSS 9.8) following public PoC release; approximately 1,512 unpatched instances remain worldwide (majority in North America). The exploit uses a spoofed AWS header, a crafted 44-character CrushAuth cookie, and c2f parameter manipulation to bypass authentication and potentially allow full system compromise; CrushFTP released patches (11.3.1 / 10.8.4) and vendors and analysts recommend immediate patching, DMZ as temporary mitigation, log auditing, and use of detection tools.