Is CVE-2025-47812 (Wing FTP Server Improper Neutralization of Null Byte or NUL Character) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-47812 to its Known Exploited Vulnerabilities catalogue on 14 July 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Wing FTP Server contains an improper neutralization of null byte or NUL character vulnerability that can allow injection of arbitrary Lua code into user session files.

How CISA KEV Signals Real-World Exploitation

CISA’s Known Exploited Vulnerabilities catalogue is the key indicator here. If a CVE appears in KEV, practitioners should treat it as confirmed active exploitation, not as a theoretical issue waiting for someone to weaponise it. For exposure checks, that means verifying whether Wing FTP Server is deployed anywhere in the estate, including internet-facing instances, forgotten test systems, and third-party managed environments.

For a public-facing file transfer product, the first question is not only whether the vulnerable component exists, but whether it is reachable by untrusted users and whether any companion controls, such as segmentation or restrictive access policies, actually reduce exposure. The vulnerability class matters because code injection into session files can turn a simple application flaw into broader server compromise.

Affected operators should consult the CISA Known Exploited Vulnerabilities Catalog for the authoritative remediation expectation and use the vendor advisory for version-specific action.

Why This Vulnerability Is Operationally Dangerous

Null byte or NUL character handling flaws often become dangerous when input is interpreted differently at different layers. In this case, the practical concern is arbitrary Lua code injection into session files, which can shift the issue from malformed input processing to code execution and durable compromise if an attacker can plant or modify session state.

That kind of flaw is especially concerning in a transfer platform because session-related files are often trusted by the application itself. If an attacker can influence those files, they may bypass ordinary request-level validation and exploit the application’s own runtime behaviour instead of relying on a noisy exploit chain.

For a broader view of how actively exploited CVEs should be prioritised, NIST NVD and the CVE Program provide the canonical record structure, while KEV tells you whether exploitation is already happening.

What To Do When Patching Has To Wait

If immediate remediation is not possible, the practical objective becomes blast-radius reduction. Restrict network access to the FTP service, remove unnecessary internet exposure, and watch for any abnormal creation or modification of session files, unexpected Lua execution, or other server-side behavioural changes that would suggest attempted abuse.

Because exploitation can already be in progress once KEV lists a CVE, delay should be treated as an exception state, not business as usual. Where the system holds credentials, session data, or other sensitive operational material, assume those artefacts may have been exposed until you have checked the host and surrounding logs.

Readers who need a structured triage approach can use Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide to anchor emergency prioritisation, verification, and post-change validation.

Risk and Threat Considerations

The main risk is not just service disruption, but trusted execution inside the application boundary. If an attacker can inject code into session handling, they may gain persistence, alter application behaviour, or pivot to adjacent data and credentials handled by the server.

Failure mechanism: An input neutralisation failure lets a NUL character change how the application parses or stores session content, creating an opening for code injection and possible server-side execution.

Impact: An attacker can move from a single vulnerable endpoint to broader compromise of the FTP service, including session manipulation, data exposure, and potentially sustained control until the host is rebuilt or thoroughly cleaned.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	DE.CM-02 — Analyzed events to detect anomalies and indicators of compromise	Actively exploited CVEs require monitoring for compromise signals.
	PR.AA-05 — Identities and credentials are managed for authorized access	Session-file code injection can expose or abuse access-bearing material.
	PR.DS-01 — Data-at-rest is protected	Session files and related stored data may be altered or exposed by the flaw.
Recommendation — Monitor Wing FTP Server logs and file activity for exploitation indicators. Tighten access to session-related files and administrative paths. Protect stored session data and verify integrity after remediation.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation calls for prioritised discovery, remediation and validation.
Recommendation — Prioritise scanning, remediation and verification for KEV-listed hosts.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question is about exploiting a software flaw that demands remediation.
Recommendation — Apply the vendor fix or mitigation and verify completion.

Practitioner Guidance

What to prioritise: Treat internet-facing Wing FTP Server systems first, then internal instances that handle sensitive file exchange or administrative access. Prioritise hosts where session integrity or local application files could be used to re-establish access after a restart or partial cleanup.

What to verify: Confirm whether you have evidence of exploitation before and after the KEV publication date, including web server logs, application errors, suspicious file writes, and any unexpected Lua-related activity. If patching is delayed, verify that compensating controls actually block untrusted reachability rather than merely reducing exposure on paper.

Practitioner takeaway: Once KEV lists a flaw like this, the decision is no longer about whether exploitation is possible, but whether you can prove you were not already exposed or compromised before remediation completed.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org