CrushFTP VFS Sandbox Escape Vulnerability Exploited in the Wild (CVE-2024-4040)

On April 19, CrushFTP posted an advisory for a flaw in its CrushFTP file transfer solution. According to researchers at CrowdStrike, this flaw has been exploited in the wild as a zero-day. Details about in-the-wild exploitation are limited but reportedly include intrusions against “multiple U.S. entities” with the objective of “intelligence-gathering.”

On April 22, a CVE was assigned for this vulnerability: CVE-2024-4040

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.