Critical Update: CrushFTP Zero-Day Flaw Exploited in Targeted Attacks

CrushFTP versions prior to v11.1 contain a critical server-side template injection (CVE-2024-4040, CVSS 9.8) that enables unauthenticated file reads and remote code execution; the flaw has been patched but was exploited in the wild in targeted attacks against U.S. entities, with Airbus CERT publishing scanners/IoC checks, Rapid7 confirming trivial exploitability, CrowdStrike reporting active use, and CISA adding it to the KEV catalog.