Vulnerabilidades de Accellion

CVE-2026-28272 Média · 4.8 CWE-79 27/02/2026

Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticated administrators to inject malicious scripts through a configuration interface. The stored script executes when users interact with the affected user interface. Version 9.2.0 contains a patch for the issue.

CVE-2026-28271 Média · 6.5 CWE-350 27/02/2026

Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.

CVE-2026-28270 Alta · 7.2 CWE-434 27/02/2026

Kiteworks Core has an Unrestricted Upload of File with Dangerous Type

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary files without proper validation. Malicious administrators could exploit this to upload unauthorized file types to the system. Version 9.2.0 contains a patch for the issue.

CVE-2026-28269 Alta · 8.8 CWE-78 26/02/2026

Kiteworks Core has an OS Command Injection

Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenticated users to redirect command output to arbitrary file locations. This could be exploited to overwrite critical system files and gain elevated access. Version 9.2.0 contains a patch.

CVE-2025-53939 Alta · 8.8 CWE-20 29/11/2025

Kiteworks Core is vulnerable to Improper Input Validation

Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0.

CVE-2025-53900 Alta · 8.8 CWE-267 29/11/2025

Kiteworks MFT has a Privilege Defined With Unsafe Actions

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.

CVE-2025-53899 Alta · 7.2 CWE-941 29/11/2025

Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream communication which could lead to an escalation of privileges. This issue has been patched in version 9.1.0.

CVE-2025-53897 Média · 6.8 CWE-352 29/11/2025

Kiteworks MFT has a Cross-Site Request Forgery (CSRF) vulnerability

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to log information from the system by tricking an administrator into browsing a specifically crafted fake page of Kiteworks MFT. This issue has been patched in version 9.1.0.

CVE-2025-53896 Alta · 8.1 CWE-613 29/11/2025

Kiteworks MFT is vulnerable to Insufficient Session Expiration

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0.

CVE-2021-27103 Crítica · 9.8 KEV Alta · 69 Ransomware CWE-918 16/02/2021

Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability

Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.

CVE-2021-27101 Crítica · 9.8 KEV Urgente · 75 Exploit público Ransomware 16/02/2021

Accellion FTA SQL Injection Vulnerability

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.

CVE-2021-27102 Alta · 7.8 KEV Alta · 64 Ransomware CWE-78 16/02/2021

Accellion FTA OS Command Injection Vulnerability

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.

CVE-2021-27104 Crítica · 9.8 KEV Urgente · 70 Ransomware CWE-78 16/02/2021

Accellion FTA OS Command Injection Vulnerability

Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.