CVE-2015-2857: Accellion File Transfer Appliance command injection via oauth_token

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and very high EPSS probability make this an urgent remote code execution risk.

What it is

Accellion File Transfer Appliance before FTA_9_11_210 passes the oauth_token parameter to a shell without sanitizing metacharacters, allowing command injection. A remote, unauthenticated attacker can run arbitrary commands on the appliance, which typically holds sensitive file transfer data and credentials.

Impact

An attacker gains remote code execution on the appliance, enabling data theft, credential access, and use of the host as a pivot into the internal network.

Attack surface

Reachable over the network through the getStatus/verify_oauth_token handling; the CVSS vector shows no privileges or user interaction required.

Exploitation

Public exploit code exists (Metasploit module, Exploit-DB 37597, Packet Storm) and EPSS is 0.84178 (99.7th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade Accellion FTA to FTA_9_11_210 or later immediately.
• If patching is not possible, restrict network access to the FTA management and OAuth endpoints to trusted sources only.
• Place the appliance behind a reverse proxy or WAF that blocks shell metacharacters in oauth_token and related parameters.
• Rotate credentials and secrets stored on or accessible from the appliance after any suspected exposure.
• Monitor vendor advisories for end-of-life status and plan migration off unsupported FTA versions.

Detection

• Inspect web and application logs for requests to getStatus/verify_oauth_token containing shell metacharacters (;, |, $(), backticks) in oauth_token.
• Alert on unexpected child processes spawned by the FTA web service (e.g., sh, bash, curl, wget, nc).
• Monitor for outbound connections from the FTA host to unusual destinations or on uncommon ports.
• Review file integrity and audit logs on the appliance for new files, cron entries, or modified binaries.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.