Is CVE-2025-31161 (CrushFTP Authentication Bypass) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-31161 to its Known Exploited Vulnerabilities catalogue on 7 April 2025, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.

What exploitation status means for a KEV-listed CVE

For this CVE, the practical answer is that exploitation status is already established by CISA’s KEV listing. That matters because KEV is not a theoretical risk register, it is a confirmed-exploitation signal that should move the vulnerability to the front of operational triage. CISA Known Exploited Vulnerabilities Catalog and the vendor advisory are the two sources to use for authoritative timing and remediation details.

When a vulnerability is on KEV, the question is no longer whether it is credible, but whether you can confirm exposure, scope the affected assets, and execute the required action quickly enough to reduce blast radius. For a remote authentication bypass, the exposure problem is especially acute because the flaw can turn a normal login path into unauthenticated access.

Why this CrushFTP flaw is operationally dangerous

This issue is dangerous because authentication bypass defects often collapse the first trust boundary in the product. If an attacker can authenticate as a known or guessable account, the compromise path may be short: access the appliance, enumerate data or sessions, and pivot into adjacent systems that trust that account or its privileges.

That is why actively exploited auth bypass flaws merit immediate inventory checks, not just patch scheduling. The highest-risk condition is not only internet exposure, but also any deployment where the targeted account has broad administrative rights, access to sensitive files, or downstream integration with other services. CVE Program records define the vulnerability, while KEV confirms that exploitation has crossed from possibility into observed abuse.

What to do if patching or mitigation cannot happen immediately

If remediation must wait, treat the system as exposed until proven otherwise. Reduce reachability first, then verify whether the vulnerable interface is still accessible from the internet or from any partner network that should not be able to reach it. Temporary controls should narrow access as much as possible while the permanent fix is prepared.

For this kind of flaw, the second priority is compromise assessment. Review authentication logs, admin actions, new or modified accounts, unusual source IPs, and any unexpected changes to file access or configuration. If the product protected credentials, tokens, or other sensitive material, assume those may need rotation even before you finish the full investigation.

Risk and Threat Considerations

KEV-listed authentication bypass vulnerabilities are attractive to attackers because they reduce effort and increase scale. Once a bypass is weaponized, opportunistic actors can probe for exposed instances, convert a single weak trust decision into authenticated access, and use that access for data theft, staging, or ransomware deployment.

Failure mechanism: The attacker abuses the authorization header handling to authenticate without legitimate credentials, then uses any known or guessable account to gain a valid session.

Impact: That can create immediate administrative compromise, exposure of stored data, and a plausible route into ransomware activity or further lateral movement if the appliance is trusted by other systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Recorded	KEV exposure assessment depends on identifying vulnerable assets quickly.
	PR.AA-01 — Identities and Credentials Are Issued, Managed, Verified, Revoked, and Audited	Authentication bypass makes credential and account trust central to response.
	RS.MA-01 — Incident Mitigation Is Executed	Active exploitation requires containment and mitigation, not just planned patching.
Recommendation — Inventory exposed instances and record this CVE as a prioritized vulnerability. Verify account and credential state, then revoke or rotate what the flaw may have exposed. Contain exposed systems and execute the required mitigation immediately.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV status makes continuous exposure checking and prioritization operationally necessary.
	IA-2 — Identification and Authentication (Organizational Users)	The flaw is an authentication bypass that defeats normal user verification.
	AC-2 — Account Management	Guessable or known accounts are a key abuse path in this exploit.
Recommendation — Scan for exposed CrushFTP instances and prioritize this flaw for immediate remediation. Enforce strong authentication paths and remove any reliance on the bypassable flow. Review privileged accounts and disable or rename weakly controlled accounts.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-driven triage is a direct vulnerability-management use case.
	CIS-6 — Access Control Management	Compromise response must constrain access to affected systems and accounts.
Recommendation — Prioritize KEV-listed vulnerabilities and verify remediation on exposed systems. Restrict access paths and remove unnecessary administrative reach immediately.

Practitioner Guidance

What to prioritise: Confirm whether the product is internet-facing, whether the vulnerable authentication path is enabled, and whether any account used by the instance has elevated privileges or access to sensitive content.

What to verify: Check for logins, session creation, account changes, and configuration edits that do not align with normal admin behaviour. If you cannot reliably distinguish legitimate from malicious use, assume the instance may already be under active abuse.

Decision rule: If the system was reachable before remediation, rotate the credentials, sessions, and related secrets that the instance could expose, then perform a targeted hunt for persistence before declaring the issue closed.

Practitioner takeaway: For a KEV-listed auth bypass, speed matters more than elegance, because the main failure is not just unauthorised entry but the loss of confidence in every action taken through that trust boundary.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org