CISA Issues Emergency Alert for Wing FTP Server Exploit
The Cybersecurity and Infrastructure Security Agency issued an urgent warning on March 16, 2026, directing federal agencies to immediately secure Wing FTP Server installations against an actively exploited vulnerability. The flaw enables attackers to execute remote code when combined with other security weaknesses in targeted systems.
CISA added the Wing FTP Server vulnerability to its Known Exploited Vulnerabilities catalog, signaling confirmed in-the-wild exploitation attempts against government infrastructure. The agency's binding operational directive requires federal civilian executive branch agencies to patch or disconnect affected systems within specified timeframes.
Federal Agencies Running Wing FTP Server at Risk
The vulnerability specifically targets organizations running Wing FTP Server software, with U.S. government agencies identified as primary targets in the current attack campaign. Wing FTP Server is commonly deployed in enterprise environments for secure file transfer operations and remote access management.
Federal agencies must inventory their Wing FTP Server deployments and assess exposure levels immediately. The vulnerability's inclusion in CISA's KEV catalog indicates threat actors are actively scanning for and exploiting vulnerable instances across government networks.
Related: Veeam Patches 5 Security Flaws, 3 Critical RCE Bugs
Related: Veeam Patches Four Critical RCE Flaws in Backup Software
Related: CISA adds Ivanti EPM flaw to exploited vulnerabilities list
Chained Exploit Enables Full System Compromise
Attackers are chaining the Wing FTP Server flaw with additional vulnerabilities to achieve remote code execution on compromised systems. The multi-stage attack vector allows threat actors to escalate privileges and maintain persistent access to targeted government infrastructure.
CISA's emergency directive mandates federal agencies apply available patches or implement compensating controls within the standard remediation timeline. Organizations should also review access logs for signs of exploitation and implement network segmentation to limit potential blast radius from compromised FTP servers.
