Actively exploited vulnerabilities affecting CrushFTP products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-54309https://wildfortech.com/security#CVE-2025-54309CrushFTP's DMZ proxy feature, when not in use, fails to properly validate AS2 protocol requests over HTTPS. This allows unauthenticated remote attackers to gain full administrator access to the CrushFTP server without any credentials. Admin-level access means an attacker can read, modify, or exfiltrate any data managed by the file transfer server, making this a critical exposure for organizations using CrushFTP for business file exchange.Tue, 22 Jul 2025 00:00:00 GMTCrushFTPCrushFTP