Read the docs
TI-2016-07765 Aliases CVE-2016-9499GHSA-64mw-c7hp-gmxw

The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.

Priority LOW 34CWE-204Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-204.

Summary

Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

Why it matters now

EPSS 0.07669 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed FTP Server (Accellion): FTA_9_12_220

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AccellionFTP ServerFTA_9_12_220 to before FTA_9_12_220FTA_9_12_220Patch availableCNA
  • FTP Server VendorAccellion Affected FTA_9_12_220 to before FTA_9_12_220 Fixed in FTA_9_12_220 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:accellion:ftp_server:*:*:*:*:*:*:*:*before fta_9_12_220VulnerableAccellion
  • cpe:2.3:a:accellion:ftp_server:*:*:*:*:*:*:*:* Versions before fta_9_12_220 Vulnerable ·Accellion

Remediation

  • Fix · CNA FTP Server (Accellion) Fixed in FTA_9_12_220

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Accellion FTP Server FTA_9_12_220

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2016-07766 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposurePriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-9499
  2. 2026-10-03 Alias added: GHSA-64mw-c7hp-gmxw

References

Exploit 1

Advisory 1

  • TI-2016-07766 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposure CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences