CISA adds Wing FTP CVE-2025-47813 to KEV catalog after active exploitation

Photo by protect.computer (custom alert graphic) on protect.computer

What happened

CISA added CVE-2025-47813 (Wing FTP Server information disclosure vulnerability) to its Known Exploited Vulnerabilities (KEV) catalog.

A KEV listing means defenders should treat this as active attacker tradecraft, not a theoretical issue.

Why this matters

Wing FTP is often internet-facing or reachable from partner networks. Information disclosure flaws can provide attackers with sensitive server data that accelerates follow-on compromise.

For organizations running exposed file transfer infrastructure, KEV additions usually compress patch timelines.

What defenders should do now

1. Inventory all Wing FTP instances (including legacy and shadow IT deployments).
2. Patch/remediate CVE-2025-47813 according to vendor guidance.
3. Restrict management interfaces to trusted networks only.
4. Hunt logs for unusual probing, path disclosure attempts, and suspicious auth behavior.
5. Add temporary compensating controls (WAF/access restrictions) where patch windows are delayed.

Bottom line

When CISA adds a CVE to KEV, speed matters. If Wing FTP is in your environment, prioritize remediation as an active-risk event.