CVE-2024-5276: Fortra FileCatalyst Workflow SQL injection allows data modification

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.1 with network reachability, no privileges or user interaction required, high EPSS, and a public exploit reference, though KEV listing is absent.

What it is

Fortra FileCatalyst Workflow contains a SQL injection flaw (CWE-89, improper input validation) that lets an attacker modify application data, including creating administrative users and deleting or altering database records. Data exfiltration via the injection is not possible. The issue affects all versions from 5.1.6 Build 135 and earlier.

Impact

An attacker can create administrative accounts and delete or modify data in the application database, leading to full application compromise and integrity loss. Confidentiality is not impacted per the CVSS vector.

Attack surface

Reachable over the network with no authentication and no user interaction when anonymous access is enabled on the Workflow system; otherwise an authenticated user is required. The CVSS vector is AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is very high (0.90067, 99.788th percentile) and a third-party advisory is tagged Exploit, indicating public exploit information exists.

What to do

• Apply the vendor fix or mitigation from Fortra advisory FI-2024-008 and the FileCatalyst Workflow KB article; upgrade beyond 5.1.6 Build 135.
• Disable anonymous access on FileCatalyst Workflow systems where it is not strictly required.
• Restrict network exposure of the Workflow interface to trusted networks or place it behind a VPN or reverse proxy with access controls.
• Enforce least privilege on the database account used by FileCatalyst Workflow to limit the scope of data modification.
• Audit existing administrative accounts and database records for unauthorized changes.

Detection

• Monitor Workflow and database logs for SQL syntax anomalies, unexpected query errors, or injection-like payloads in request parameters.
• Alert on creation of new administrative users or privilege changes in FileCatalyst Workflow.
• Baseline and monitor for unusual bulk deletions or modifications in the application database.
• Review access logs for unauthenticated requests to Workflow endpoints when anonymous access is enabled.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.