Wing FTP Server 8.1.3 · Authenticated Remote Code Execution
Source Exploit-DB RSS Feed
Public exploit available (Exploit-DB) · fixed in 8.1.3 : patch affected systems as a priority.
Data as of 29 Oct 2026, 19:04 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 2.6% chance of exploitation in 30 days – higher than 85% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 8.1.3
Exploitation evidence
Disclosed: evidence found.
Public on cve.org; its publication date is not in this record
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
AI-suggested
Upgrade Wing FTP Server to version 8.1.3 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated.
Description
Wing FTP Server 8.1.3 - Authenticated Remote Code Execution
Indicators of compromise
Exploit source code
# Exploit Title: Wing FTP Server 8.1.3 - Authenticated Remote Code Execution
# Date: 12.05.2026
# Exploit Author: Ünsal Furkan Harani
# Vendor Homepage:
[https://www.wftpserver.com/](https://www.wftpserver.com/download.htm)
# Software Link:
https://www.wftpserver.com/download.htm
# Version: v8.1.2
# Tested on: Wing FTP Server <= 8.1.2, fixed in 8.1.3
# CVE : CVE-2026-44403
Wing FTP Server v8.1.2 contains a Remote Code Execution (RCE) vulnerability in the session serialization mechanism. An aut…