CISA Warns of Active CrushFTP Authentication Bypass Exploit

CISA has issued a warning about a critical vulnerability (CVE-2025-31161) in CrushFTP that is being actively exploited. This flaw allows attackers to bypass authentication, putting systems at serious risk. The agency has added it to the Known Exploited Vulnerabilities Catalog, urging organizations to patch immediately.

CVE-2025-31161

Identified as CVE-2025-31161, this flaw allows attackers to bypass authentication and gain unauthorized access to sensitive systems.

CrushFTP is commonly used by federal agencies, enterprises, and small businesses, making this vulnerability a serious risk to critical infrastructure and data.

Why This Matters

Attackers can exploit this flaw to bypass security, access restricted systems, and potentially carry out further malicious activities. CISA has added CVE-2025-31161 to its Known Exploited Vulnerabilities Catalog, emphasizing the need for immediate action.

Federal Directive: BOD 22-01

Under Binding Operational Directive 22-01, all Federal Civilian Executive Branch (FCEB) agencies are required to fix known exploited vulnerabilities within a set timeframe. This directive aims to reduce the risk of cyberattacks on government networks.

CISA is urging not only federal agencies but also private companies and state governments to patch this vulnerability without delay.

What Organizations Should Do

• Apply patches released by CrushFTP developers as soon as possible.
• Check system logs for any unusual activity that may indicate exploitation attempts.
• Review security controls and ensure all systems are updated.

CISA’s Recommendations

• Prioritize patching all vulnerabilities listed in the Known Exploited Vulnerabilities Catalog.
• Strengthen monitoring for suspicious activity.
• Conduct regular security audits to reduce exposure to future threats.

The exploitation of CVE-2025-31161 highlights the growing risk posed by unpatched systems. Organizations must stay proactive to protect against evolving cyber threats.

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!