CVE-2016-2351: Accellion File Transfer Appliance

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.

Affected products

• Accellion File Transfer Appliance: up to and including 9_11_210

Published 2016-05-07. Last modified 2026-06-17.