Attackers are exploiting a critical authentication bypass vulnerability (CVE-2025-2825) in CrushFTP file transfer software, allowing unauthenticated access to unpatched versions. CrushFTP has urged users to update their software immediately, while security monitoring platforms report numerous exploitation attempts against exposed servers. A workaround is available for those unable to update right away, but vulnerability remains a significant concern, especially given past attacks linked to ransomware gangs.