Warning: Critical improper authentication vulnerability in CrushFTP, Patch Immediately!

CrushFTP versions 10.0.0–10.8.3 and 11.0.0–11.3.0 contain a critical improper authentication vulnerability (CVE-2025-2825 / CVE-2025-31161, CVSS 9.8) that allows unauthenticated remote attackers to gain full administrative access, read and modify host files, and potentially enable lateral movement; a public PoC and Nuclei template exist and there are reports of active exploitation and confirmed ransomware/data exfiltration, so organizations should urgently apply vendor patches (upgrade to 10.8.3 or 11.3.0+) or implement mitigations and increase monitoring.