CrushFTP Authentication Bypass and ePHI Risk

Historical catalog analysis: CISA added this entry on April 07, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-31161 is an authentication bypass vulnerability located in the HTTP authorization header of CrushFTP. This flaw allows a remote, unauthenticated attacker to authenticate as any known or guessable user account, such as the administrative ‘crushadmin’ account. Successful exploitation could potentially lead to a full compromise of the affected system.

Exposure and applicability

In healthcare environments, file transfer solutions like CrushFTP are frequently utilized by providers and business associates to exchange electronic Protected Health Information (ePHI) with partners, labs, or insurance payers. Because this vulnerability allows an attacker to bypass authentication entirely, any instance of CrushFTP exposed to the internet or untrusted internal segments represents a significant risk to the confidentiality and integrity of patient data.

CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog as of April 7, 2025, noting that it has been used in known ransomware campaigns. For healthcare organizations, this increases the risk not only of data theft but also of operational disruption and loss of patient care continuity if ransomware is deployed via this entry point.

Remediation priorities

Based on our analysis of the vulnerability’s impact on HIPAA Security Rule risk management, we suggest the following prioritized actions:

1. Immediate Version Audit: Identify all instances of CrushFTP across the network. This should be led by IT infrastructure or security teams to determine if current versions are susceptible.
2. Apply Vendor Mitigations: Following vendor instructions to apply available mitigations is the primary priority to close the authentication bypass gap.
3. Evaluate Product Viability: If mitigations are unavailable for a specific deployment, organizations should consider discontinuing use of the product to prevent unauthorized access to ePHI.
4. Review Cloud Service Guidance: For those utilizing CrushFTP via cloud services, we recommend following applicable BOD 22-01 guidance to ensure service providers have addressed the flaw.

How to validate remediation

To verify that exposure has been reduced, security leaders should coordinate with their IT teams to confirm that vendor-recommended updates or mitigations have been successfully applied. Validation should involve verifying the current software version against the vendor’s patched release list.

Organizations should avoid performing intrusive penetration testing or unauthorized exploit attempts on production systems containing ePHI; instead, validation should rely on configuration audits and official vendor documentation.

Limits and open questions

Applying mitigations could reduce the likelihood of exploitation, but it does not guarantee total immunity from all attack vectors. It remains unclear exactly how many healthcare-specific entities have been targeted by the ransomware campaigns mentioned by CISA. Furthermore, while federal agencies face a specific CISA deadline of April 28, 2025, private healthcare providers must determine their own remediation timelines based on their internal risk assessments and HIPAA compliance obligations.

Source and editorial note

CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability · Source date: April 07, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 10, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 15, 2026 at 01:07 UTC.

Request a healthcare security assessment