CVE-2016-9499: Accellion FTP Server

Medium severity, CVSS 5.3. EPSS: 7.7% chance of exploitation in the next 30 days.

Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

Affected products

• Accellion FTP Server: before fta_9_12_220 (fixed in fta_9_12_220)

Published 2018-07-13. Last modified 2026-06-17.