What’s That Coming Over The Hill? (Monsta FTP Remote Code Execution CVE-2025-34299) - watchTowr Labs
Source Reddit NetSec
Not known to be exploited · public exploit available (Metasploit) · 72% EPSS.
Data as of 26 Oct 2026, 06:26 UTC
Likely to be exploited
72.6% EPSS · Critical severity · No CVSS score from NVD or the CNA
- EPSS
- 72.6% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: evidence found.
nuclei template: Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution
Weaponised: evidence found.
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
Until patches are available, restrict access to the Monsta FTP interface to trusted networks or users only. Monitor for suspicious activity related to Monsta FTP usage. Prioritize detection and containment measures to reduce exposure. Avoid relying on generic security hygiene unrelated to this specific vulnerability.
Description
CVE-2025-34299 is a remote code execution vulnerability in Monsta FTP, a web-based FTP client. It allows attackers to execute arbitrary code remotely without user interaction. No active exploits have been observed in the wild yet. The vulnerability poses risks to confidentiality, integrity, and availability of affected systems. European organizations, especially in critical infrastructure sectors, are highlighted as higher risk due to their use of Monsta FTP. The vulnerability can be exploited remotely, increasing its threat potential. Mitigation includes applying patches when available, restricting access to the FTP interface, and monitoring for suspicious activity. The suggested severity is high given the ease of exploitation and potential impact. Defenders should prioritize detection, containment, and access control while awaiting official patches.