Which versions of Wing FTP Server are affected by CVE-2026-44403?

Wing FTP Server 8.1.2 contains a remote code execution vulnerability exploitable by domain administrators through malicious Lua code injection during session serialization.

Is there a public PoC exploit available for CVE-2026-44403?

Yes, a public proof-of-concept exploit is available for CVE-2026-44403. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-44403?

Within 24 hours: conduct inventory of all Wing FTP Server 8.1.2 instances and review domain administrator access logs for suspicious activity. Within 7 days: implement network segmentation restricting FTP server access to trusted networks only, enforce privileged access management for all domain administrator accounts, and disable Lua scripting if not operationally required. Within 30 days: migrate to an alternative FTP server with active security updates or deploy comprehensive logging and alerting on Lua execution and session activities to detect exploitation attempts.

Wing FTP Server CVE-2026-44403

Q: What is the CVSS score of CVE-2026-44403?

CVE-2026-44403 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29848 HIGH

Code Injection (CWE-94)

2026-05-12 VulnCheck

GHSA-ffh5-r5xj-cgmg

RCE Code Injection Wing Ftp Server

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable admin interface (AV:N/AC:L) but requires domain administrator privileges (PR:H) with no user interaction; injected code yields full C/I/A impact within the server process, no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:23 vuln.today

CVSS changed

May 12, 2026 - 21:22 NVD

7.2 (HIGH) 8.6 (HIGH)

CVE Published

May 12, 2026 - 20:43 nvd

HIGH 8.6

DescriptionCVE.org

Wing FTP Server 8.1.2 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().

AnalysisAI

Authenticated remote code execution in Wing FTP Server 8.1.2 lets a domain administrator inject arbitrary Lua code by abusing the session serialization routine, which writes session values into Lua source without escaping closing delimiters. When the poisoned session is later reloaded through loadfile(), the attacker's Lua executes on the server. Publicly available exploit code exists (Exploit-DB 52589, VulnCheck advisory), but there is no evidence of active exploitation and EPSS is very low (0.09%).

Technical ContextAI

Wing FTP Server is a commercial multi-protocol (FTP/FTPS/SFTP/HTTP) file transfer server whose administrative and scripting layer is built on an embedded Lua interpreter. Session state is persisted by serializing values directly into a generated Lua source file, then re-materializing that file at runtime with loadfile(). Because the serializer does not escape Lua string-closing delimiters (e.g. quotes/long-bracket terminators), attacker-controlled input in the domain admin 'mydirectory' field can break out of its intended string literal and become executable code - the classic CWE-94 (Improper Control of Generation of Code / 'Code Injection') pattern. The affected component is identified by CPE cpe:2.3:a:wing_ftp_server:wing_ftp_server, and the flaw is a design weakness in the serialization/deserialization path rather than a memory-safety bug.

RemediationAI

Upgrade to a fixed Wing FTP Server release once published - no exact patched version number is confirmed in the available data, so consult the vendor version history at https://www.wftpserver.com/serverhistory.htm for the first release after 8.1.2 and the VulnCheck advisory (https://www.vulncheck.com/advisories/wing-ftp-server-authenticated-remote-code-execution-via-session-serialization) for the fixed build before deploying. Until a patched build is applied, reduce exposure by tightly restricting who holds domain administrator accounts and enforcing strong, unique credentials plus MFA on the admin web interface, since exploitation requires admin-level access; additionally, restrict network access to the administration console to trusted management hosts or a VPN so stolen credentials cannot be used remotely, and audit the 'mydirectory' domain admin field and generated session files for anomalous Lua content. These controls limit reachability but do not remove the underlying injection, which only the vendor fix addresses.