CVE-2024-4040 is a VFS sandbox escape vulnerability in CrushFTP CrushFTP. CISA added it to the Known Exploited Vulnerabilities catalogue on 24 April 2024, which means attackers have used it in real attacks. CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
What a VFS sandbox escape means in an FTP server
A virtual file system sandbox is meant to keep a file-transfer service inside a constrained view of storage. A sandbox escape means the attacker can break out of that view and reach files or paths the application intended to keep separate.
In an FTP product, that boundary matters because the server is already designed to move files on a remote user’s behalf. If the sandbox fails, the issue is not just unauthorized browsing, but potential access to data outside the normal transfer scope.
Why this vulnerability class is dangerous
Sandbox escapes are dangerous because they convert a scoped file-access weakness into broader filesystem exposure. The attacker may be able to read, modify, or delete content that was never meant to be reachable through the FTP interface.
That makes the risk especially serious when the server stores sensitive uploads, configuration files, automation artifacts, or other operational data in adjacent paths. For a remotely reachable service, the attack surface is often internet-facing and exposed to opportunistic exploitation as soon as the flaw becomes known.
How organisations check exposure and prioritize response
Exposure review starts with an accurate asset inventory: which CrushFTP instances exist, where they sit, and whether they are reachable from untrusted networks. From there, teams should compare those assets against the vendor advisory and the CISA KEV catalogue rather than relying on memory or incomplete internal records.
That check is important because a vulnerability may exist in a lab, internal system, or decommissioned host without being operationally relevant, while a single public-facing deployment can be immediately high priority. The right question is not only whether the software is installed, but whether the vulnerable service is deployed in a way that an attacker can reach and abuse.
Remediation, detection, and post-incident review
The primary response is to apply the vendor’s fix as soon as practical. If patching must be delayed, reduce exposure by restricting network access, removing internet reachability, tightening account permissions around the service, and isolating the affected instance from sensitive data paths.
Detection should focus on unusual file access patterns, unexpected traversal outside normal transfer directories, and signs that the server touched paths it normally would not use. After patching, review whether the system was accessed during the exploitation window, because a fixed vulnerability does not prove the host was never compromised.
If there is any evidence of exploitation, treat filesystem exposure as a potential identity and access event as well, since an attacker who reaches file content may also obtain credentials, tokens, private keys, session material, or configuration secrets stored nearby.
Risk and Threat Considerations
This vulnerability is materially risky because it can turn a trusted file-transfer boundary into a path to broader host or data exposure. Once that boundary is broken, the attacker may move from file access to credential theft, tampering, or follow-on intrusion.
Failure mechanism: The sandbox no longer enforces the intended separation between the FTP process and the rest of the filesystem, so remote input can influence file access outside the allowed VFS scope.
Impact: Successful exploitation can expose confidential files, support persistence through altered configuration, and create secondary compromise if secrets or keys are stored on or near the affected system.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Vulnerabilities in exposed services require rapid remediation and verification. |
| AC-6 — Least Privilege | A sandbox escape becomes more damaging when the service can reach more than it needs. | |
| Recommendation — Track the CrushFTP flaw as a remediated vulnerability and verify affected systems are patched. Constrain the service to the minimum file and system access needed for operation. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Exposure checks, prioritization and remediation are central to an actively exploited CVE. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Restricting reachability and tightening deployment settings directly reduces exploit exposure. | |
| Recommendation — Inventory the server, validate exposure, and prioritize remediation based on exploitability. Harden the deployment and remove unnecessary network exposure until the fix is applied. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Identification | Identifying vulnerable instances and internet exposure is the first step in response. |
| Recommendation — Identify every CrushFTP instance and confirm whether it is exposed to untrusted networks. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org