What’s Vulnerable › Vulnerabilities

CVE-2016-9499: The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-13 · updated 2026-06-17
• Weakness: CWE-204

Description

Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

Affected products

• Accellion FTP Server: before fta_9_12_220 — fixed in fta_9_12_220

How to fix

Upgrade to a fixed version: Accellion FTP Server fta_9_12_220. Check the vendor advisory for mitigations.

References

• https://www.kb.cert.org/vuls/id/745607
• https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
• https://www.securityfocus.com/bid/96154
• https://www.kb.cert.org/vuls/id/745607
• https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
• https://www.securityfocus.com/bid/96154

Get alerted when CVE-2016-9499 or the next vulnerability affects your stack