What’s Vulnerable › Vulnerabilities

CVE-2016-9500: The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposure

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-13 · updated 2026-06-17
• Weakness: CWE-80

Description

Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.

Affected products

• Accellion FTP Server: before fta_9_12_220 — fixed in fta_9_12_220

How to fix

Upgrade to a fixed version: Accellion FTP Server fta_9_12_220. Check the vendor advisory for mitigations.

References

• https://www.kb.cert.org/vuls/id/745607
• https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
• https://www.securityfocus.com/bid/96154
• https://www.kb.cert.org/vuls/id/745607
• https://www.qualys.com/2016/12/06/qsa-2016-12-06/qsa-2016-12-06.pdf
• https://www.securityfocus.com/bid/96154

Get alerted when CVE-2016-9500 or the next vulnerability affects your stack