Is CVE-2025-54309 (CrushFTP Unprotected Alternate Channel) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-54309 to its Known Exploited Vulnerabilities catalogue on 22 July 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. CrushFTP contains an unprotected alternate channel vulnerability. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.

What the CISA KEV listing tells you about active exploitation

CISA’s KEV catalogue is the practical signal that matters first: when a CVE appears there, defenders should assume exploitation is already happening somewhere, even if they have not yet seen impact in their own environment. For this question, that means the issue is not theoretical. It is a live exposure that requires immediate exposure checking and response planning.

CISA Known Exploited Vulnerabilities Catalog is the authoritative source for confirming that status and for checking whether the entry is still current.

Why an unprotected alternate channel is dangerous in practice

An unprotected alternate channel is risky because it can give an attacker a second path into the product that bypasses the normal trust boundary. In practice, that often means access control, authentication checks, or session handling are enforced on the primary path but not consistently on the alternate one. Once that gap exists, the attacker may be able to reach administrative functions, sensitive data, or further internal capabilities without the expected controls.

CVE Program is the canonical place to verify the vulnerability record itself, while the vendor advisory should be used for the exact product-specific remediation details.

NIST National Vulnerability Database is useful when you need a normalized view of the record, references, and any linked metadata while triaging exposure.

What to do first if you run CrushFTP

The first step is simple triage: determine whether any internet-facing or internally reachable instance of the affected product is in service, then compare your deployed version and configuration against the vendor guidance. If the system is exposed, treat the issue as urgent rather than waiting for routine maintenance. If patching is delayed, reduce reachable surfaces, restrict access paths, and remove any unnecessary exposure until the fix is applied.

Zero-Day and Exploited Vulnerabilities Guide is the best internal reference for KEV-driven triage, emergency mitigation, and post-patch hunting.

Vulnerability Management Guide is the broader operational playbook for asset scoping, prioritisation, exception handling, and verification after remediation.

Risk and Threat Considerations

KEV inclusion means the risk is already elevated from a defender’s point of view, because the vulnerability is no longer just a code flaw, it is an actively abused entry point. The main concern is not only initial compromise, but also what an attacker can do if the alternate channel exposes authenticated functions, sensitive files, or operational control paths.

Failure mechanism: The alternate channel can bypass the product’s intended access checks, letting a remote attacker reach functionality that should have been gated by normal authentication or authorization controls.

Impact: Successful exploitation can lead to unauthorized access, data exposure, service takeover, or a foothold for follow-on activity, so teams should also review logs for evidence of earlier compromise, not just apply the fix and move on.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require fast identification, prioritisation, and remediation.
Recommendation — Prioritise and remediate KEV-listed exposures immediately.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This question is about confirming exposure and tracking an actively exploited vulnerability.
	SI-2 — Flaw Remediation	The answer directs urgent patching or mitigation after exploitation is confirmed.
Recommendation — Scan for the affected product and verify exposure against current vulnerability data. Apply the vendor fix or mitigation as soon as possible.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	An unprotected alternate channel in exposed software matches public-facing exploitation behavior.
Recommendation — Hunt for exploitation attempts against exposed services and related logs.
NIST CSF 2.0	ID.RA-01 — Vulnerabilities in Assets Are Identified and Recorded	The response depends on identifying whether the vulnerable product exists in the environment.
Recommendation — Inventory assets and record where the vulnerable product is deployed.

Practitioner Guidance

What to verify: Confirm whether the product is present anywhere in your estate, whether it is reachable from untrusted networks, and whether any compensating control actually blocks the vulnerable path. Do not assume an internal deployment is safe just because it is not internet-facing, especially if users, partners, or automation can still reach it.

Decision rule: If the instance is exposed and cannot be patched immediately, treat it as a containment problem, not a scheduling problem. Prioritise reducing access, then patch or mitigate, then hunt for signs of access that occurred before remediation.

Practitioner takeaway: For a KEV-listed flaw, the right sequence is exposure check, containment or patching, then compromise review. The question is not whether exploitation is possible, but whether your environment has already been reachable long enough to have been used.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org