Accellion FTA Server-Side Request Forgery (SSRF)
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
Isolate the Accellion FTA appliance in a highly restricted network segment, limiting its outbound connectivity to only trusted and essential destinations. Implement Web Application Firewall (WAF) rules to scrutinize and block unusual POST requests to wmProgressstat.html, especially those attempting to target internal IP ranges. Enhance logging and monitoring for the FTA appliance to detect unusual outbound connection attempts or internal resource access patterns, alerting security teams immediately.
The permanent resolution is to immediately upgrade the Accellion FTA appliance to a patched version that addresses this vulnerability. Specifically, all installations of Accellion FTA 9_12_411 and earlier should be updated to version FTA_9_12_416 or a subsequent secure release. This upgrade will correctly sanitize and validate user-supplied input, preventing SSRF attacks.
An attacker can exploit this vulnerability to perform Server-Side Request Forgery, causing the Accellion FTA server to make arbitrary requests to internal network resources. This allows access to sensitive data, interaction with internal services, or bypassing network segmentation rules. Successful exploitation could lead to data exfiltration, unauthorized access to internal systems, or further compromise of the internal network.
Other CVEs affecting fta
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.