Accellion

Records128All Threatist records

Exploited (KEV)4In CISA KEV

CVSS critical24CVSS 9.0–10.0

CVSS high58CVSS 7.0–8.9

Exploited now

Accellion records in CISA KEV

TI-2021-08669 Accellion FTA SQL Injection Vulnerability CRITICAL 100KEV 2021-11-03 TI-2021-08670 Accellion FTA OS Command Injection Vulnerability CRITICAL 93KEV 2021-11-03 TI-2021-08671 Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability CRITICAL 100KEV 2021-11-03 TI-2021-08672 Accellion FTA OS Command Injection Vulnerability CRITICAL 100KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Kiteworks 82 records HIGH File Transfer Appliance 20 records HIGH Secure File Transfer Appliance 7 records MEDIUM Fta 6 records CRITICAL Kiteworks Managed File Transfer 4 records MEDIUM Kiteworks Appliance 3 records LOW Ftp Server 2 records LOW Managed File Transfer 1 record LOW

Records

128 records

TI-2021-08672 CVE-2021-27104 · GHSA-54w2-m25f-gmqp

Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST…

CRITICAL 100KEV

Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.56686 Published 2021-02-16 No fix listed CWE-78

TI-2021-08671 CVE-2021-27103 · GHSA-j665-969m-hg73

Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to…

CRITICAL 100KEV

Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.11406 Published 2021-02-16 No fix listed CWE-918

TI-2021-08669 CVE-2021-27101 · GHSA-gc74-7wpx-43ch

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header…

CRITICAL 100KEV

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05998 Published 2021-02-16 No fix listed

TI-2021-08670 CVE-2021-27102 · GHSA-vcwv-2759-43q3

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web…

CRITICAL 93KEV

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.03654 Published 2021-02-16 No fix listed CWE-78

TI-2015-02522 CVE-2015-2857 · GHSA-2qg2-967q-rc49

Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute…

HIGH 83

Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84178 Published 2017-08-22 No fix listed CWE-77

TI-2021-11694 CVE-2021-31586 · GHSA-78mg-v5p2-3xjr

Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.

HIGH 67

Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.44106 Published 2021-06-23 No fix listed CWE-89

TI-2015-02521 CVE-2015-2856 · GHSA-ffv8-9h6w-3f22

Directory traversal vulnerability in the template function in function.inc in Accellion…

HIGH 66

Directory traversal vulnerability in the template function in function.inc in Accellion File Transfer Appliance devices before FTA_9_11_210 allows remote attackers to read arbitrary files via a ..

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.56573 Published 2017-10-10 No fix listed CWE-22

TI-2023-06652 CVE-2023-7273 · GHSA-jmcc-268g-jp5g

Cross Site Request Forgery in Kiteworks OwnCloud

HIGH 65

Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00217 Published 2024-10-01 No fix listed CWE-352

TI-2017-05869 CVE-2017-8303 · GHSA-7h3r-xf2x-c3p7

An issue was discovered on Accellion FTA devices before FTA_9_12_180.

MEDIUM 63

An issue was discovered on Accellion FTA devices before FTA_9_12_180.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.2418 Published 2017-05-05 No fix listed CWE-116

TI-2026-65251 CVE-2026-102115

Kiteworks Core Authentication Bypass in the Password Reset Workflow

MEDIUM 51

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01026 Published 2026-09-30 Fixed in 9.5.0 CWE-640

TI-2026-65284 CVE-2026-102149

Kiteworks Email Protection Gateway Improper Access Control

MEDIUM 48

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00239 Published 2026-09-30 Fixed in 9.5.1 CWE-306

TI-2026-65241 CVE-2026-102105

Kiteworks Email Protection Gateway server-side request forgery

MEDIUM 48

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00524 Published 2026-09-30 Fixed in 9.5.0 CWE-918

TI-2026-65242 CVE-2026-102106

Kiteworks Email Protection Gateway improper authentication

MEDIUM 47

Improper authentication in a Kiteworks Email Protection Gateway administrative service.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01071 Published 2026-09-30 Fixed in 9.5.0 CWE-287

TI-2026-65238 CVE-2026-102102

Kiteworks Email Protection Gateway server-side request forgery

MEDIUM 47

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00813 Published 2026-09-30 Fixed in 9.5.0 CWE-918

TI-2026-65231 CVE-2026-102095

Kiteworks Email Protection Gateway server-side request forgery

MEDIUM 47

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00408 Published 2026-09-30 Fixed in 9.5.0 CWE-918

TI-2017-06305 CVE-2017-8794 · GHSA-5359-92wf-c9gq

An issue was discovered on Accellion FTA devices before FTA_9_12_180.

MEDIUM 47

An issue was discovered on Accellion FTA devices before FTA_9_12_180.

CVSS 3.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01895 Published 2017-05-05 No fix listed CWE-918

TI-2026-65283 CVE-2026-102147

Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)

MEDIUM 46

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator wh…

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00462 Published 2026-09-30 Fixed in 9.5.1 CWE-79

TI-2026-65240 CVE-2026-102104

Kiteworks Email Protection Gateway server-side request forgery

MEDIUM 46

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00715 Published 2026-09-30 Fixed in 9.5.0 CWE-918

TI-2026-65239 CVE-2026-102103

Kiteworks Email Protection Gateway server-side request forgery

MEDIUM 46

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00715 Published 2026-09-30 Fixed in 9.5.0 CWE-918

TI-2016-02114 CVE-2016-2352 · GHSA-8467-3m53-p58p

The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote…

MEDIUM 46

The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05381 Published 2016-05-07 No fix listed CWE-264

TI-2021-09141 CVE-2021-27730 · GHSA-6346-27p9-5355

Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST…

MEDIUM 45

Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01454 Published 2021-03-02 No fix listed CWE-74

TI-2019-03988 CVE-2019-5623 · GHSA-ppwj-cv8x-vq3q

Accellion File Transfer Appliance Improper Neutralization of Special Elements used in a Command ('Command Injection')

MEDIUM 45

Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01578 Published 2020-04-29 No fix listed CWE-77

TI-2017-06301 CVE-2017-8790 · GHSA-vmxx-hrq4-4r4j

An issue was discovered on Accellion FTA devices before FTA_9_12_180.

MEDIUM 45

An issue was discovered on Accellion FTA devices before FTA_9_12_180.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01373 Published 2017-05-05 No fix listed CWE-90

TI-2016-02113 CVE-2016-2351 · GHSA-76jv-j36q-7f6q

SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File…

MEDIUM 45

SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01579 Published 2016-05-07 No fix listed CWE-89

TI-2026-65257 CVE-2026-102121

Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor

MEDIUM 44

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00451 Published 2026-09-30 Fixed in 9.5.1 CWE-200

Open these records in search →