Accellion FTA OS Command Execution Vulnerability
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Groups documented using the techniques observed against this CVE — a tradecraft association, not a confirmed attribution. Overlap count shown; click for the MITRE profile.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Immediately restrict network access to Accellion FTA admin interfaces to only trusted administrators from secure, segmented networks. Implement Web Application Firewall (WAF) rules to detect and block requests targeting known vulnerable endpoints or containing suspicious command injection patterns. Enhance monitoring for unusual activity originating from or directed at the FTA server, focusing on anomalous process execution or outbound network connections.
The permanent resolution is to upgrade Accellion FTA instances to version 9_12_380 or later as soon as possible. Affected versions include Accellion FTA 9_12_370 and all earlier releases. After upgrading, verify that the patch has been successfully applied and conduct a thorough security review to ensure no lingering compromise.
This critical vulnerability allows an unauthenticated attacker to execute arbitrary operating system commands on the underlying server via specially crafted POST requests to various admin endpoints. Successful exploitation can lead to complete system compromise, unauthorized data exfiltration, service disruption, and serve as a pivot point for further attacks within the network, causing significant business disruption and reputational damage. The technical control over the system provides attackers with the highest level of privilege.
Other CVEs affecting fta
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.