Accellion FTA OS Command Execution Vulnerability
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An attacker with a basic user account, with local access to the host, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Groups documented using the techniques observed against this CVE — a tradecraft association, not a confirmed attribution. Overlap count shown; click for the MITRE profile.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Restrict network access to the Accellion FTA appliance, allowing connections only from trusted internal networks or specific IP addresses. Implement robust monitoring for unusual activity, command execution, or outbound connections originating from the FTA server to detect exploitation attempts. Isolate the FTA appliance in a separate network segment with strict egress filtering.
Upgrade the Accellion FTA appliance to version FTA_9_12_416 or later immediately. Review vendor documentation for specific upgrade procedures and any pre/post-installation checks required to ensure proper application of the patch. After patching, conduct a thorough security audit to confirm no compromise occurred prior to the fix.
An attacker can achieve arbitrary operating system command execution on the Accellion FTA appliance. This allows for full system compromise, including data exfiltration, service disruption, and the potential for further network pivot, leading to severe data breaches and operational damage.
Other CVEs affecting fta
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.