← Vulnerability feed

Vulnerability record · CVE-2016-2352 · published 7 May 2016

CVE-2016-2352: Accellion file transfer appliance permissions and access controls vulnerability

Accellion · File Transfer Appliance

The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.

8.8 CVSS 3.0 High EPSS 5.4% · top 7.6% CWE-264 · Permissions and access controls
8.8CVSS 3.0 base score, v2 6.5
5.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/
http://www.kb.cert.org/vuls/id/505560 Third Party AdvisoryUS Government Resource
http://devco.re/blog/2016/04/21/how-I-hacked-facebook-and-found-someones-backdoor-script-eng-ver/
http://www.kb.cert.org/vuls/id/505560 Third Party AdvisoryUS Government Resource

Track CVE-2016-2352 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2017-8794Accellion file transfer appliance server-side request forgery (ssrf) vulnerabilityAn issue was discovered on Accellion FTA devices before FTA_9_12_180. Because a regular expression (intended to match local https URLs) lacks an init…EPSS 1.9%9.8CVE-2019-5622Accellion file transfer appliance hard-coded credentials vulnerabilityAccellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.EPSS 1.1%9.8CVE-2019-5623Accellion file transfer appliance command injection vulnerabilityAccellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Comma…EPSS 1.6%9.8CVE-2015-2857Accellion File Transfer Appliance command injection via oauth_tokenAccellion File Transfer Appliance before FTA_9_11_210 passes the oauth_token parameter to a shell without sanitizing metacharacters, allowing command…EPSS 84%analysed9.8CVE-2017-8303Accellion file transfer appliance vulnerabilityAn issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in th…EPSS 24%9.8CVE-2017-8789Accellion file transfer appliance sql injection vulnerabilityAn issue was discovered on Accellion FTA devices before FTA_9_12_180. A report_error.php?year='payload SQL injection vector exists.EPSS 1.2%9.8CVE-2017-8790Accellion file transfer appliance ldap injection vulnerabilityAn issue was discovered on Accellion FTA devices before FTA_9_12_180. The home/seos/courier/ldaptest.html POST parameter "filter" can be used for LDA…EPSS 1.4%9.8CVE-2017-8796Accellion file transfer appliance sql injection vulnerabilityAn issue was discovered on Accellion FTA devices before FTA_9_12_180. Because mysql_real_escape_string is misused, seos/courier/communication_p2p.php…EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2016-2352), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.