CVE-2020-37079: 
Wing FTP Server vulnerability analysis and mitigation

CVE-2020-37079 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wing FTP Server web administration interface affecting all versions prior to 6.2.7. The flaw allows attackers to delete administrative user accounts without proper authorization by tricking an authenticated administrator into visiting a malicious page. It was published on February 7, 2026, and carries a CVSS v3.1 base score of 3.5 (Low) (Feedly, Exploit-DB).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). An attacker crafts a malicious HTML page containing a hidden form that, when loaded by an authenticated Wing FTP Server administrator, automatically submits a forged HTTP request to the web administration interface to delete an admin user account. Exploitation requires the victim to be authenticated to the Wing FTP Server admin panel and to visit the attacker-controlled page, making user interaction a necessary precondition. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB, Feedly).

Successful exploitation allows an attacker to delete administrative user accounts from the Wing FTP Server, potentially locking legitimate administrators out of the management interface entirely. This results in a loss of administrative access and disruption of server management capabilities, with integrity impact on the admin account configuration. There is no direct confidentiality or availability impact on the underlying FTP service data, but loss of admin access could impair the ability to manage or secure the server (Feedly).

A proof-of-concept exploit is publicly available on Exploit-DB (EDB-48200), added to tracking on February 18, 2026 (Exploit-DB). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify Wing FTP Server instances running versions prior to 6.2.7 with the web administration interface exposed, using network scanning or web fingerprinting tools.
2. Craft malicious page: Create an HTML page containing a hidden form that targets the Wing FTP Server admin endpoint responsible for deleting admin users (e.g., a POST request to the admin user deletion action).
3. Deliver payload: Trick an authenticated Wing FTP Server administrator into visiting the malicious page via phishing email, social engineering, or by embedding the page in a site the admin is likely to visit.
4. CSRF execution: When the admin loads the page, the hidden form auto-submits the forged request using the admin's active session cookies, causing the server to delete the targeted admin account without the victim's knowledge.
5. Achieve objective: The targeted admin account is deleted, potentially locking legitimate administrators out of the Wing FTP Server management interface (Exploit-DB, Feedly).

• Logs: Wing FTP Server administration logs showing unexpected admin user account deletion events, particularly those not initiated by a known administrator action.
• Logs: HTTP access logs showing POST requests to admin user management endpoints originating from unexpected referrer URLs or with unusual session patterns.
• Network: Outbound or cross-origin requests from the admin browser session to the Wing FTP Server admin interface triggered by third-party pages (detectable via browser-side monitoring or proxy logs).
• Application: Sudden disappearance of administrative accounts from the Wing FTP Server user list without corresponding change management records (Feedly).

Upgrade Wing FTP Server to version 6.2.7 or later, which addresses this CSRF vulnerability. As interim mitigations, restrict access to the web administration interface to trusted internal networks or VPN-only access using firewall rules or network segmentation. Additionally, implement browser-level protections such as ensuring the admin interface uses SameSite cookie attributes and origin validation. Monitor Wing FTP Server administration logs for unexpected admin account deletion events (Feedly).