CVE-2009-4646: Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer A...

Security readout for executives and security teams

This is an old Accellion Secure File Transfer Appliance issue where an authenticated administrator could abuse an SNMP setting update to run shell commands on the appliance. The sources do not provide CVSS, affected versions, or a named patch. Exposure is most likely in organizations still running legacy Accellion Secure File Transfer Appliance instances, especially where the administrative web interface is reachable beyond tightly controlled management networks. The bundle does not identify affected versions. Prioritize discovery and containment if any Accellion SFTA remains in use. The issue enables command execution, but the known prerequisite is administrator authentication and the provided evidence lacks active exploitation data. Mitigation focus: Check Accellion/vendor guidance for fixed versions, replacements, or decommissioning advice.; Restrict administrative web access to trusted management networks or VPN only.; Review administrator accounts and remove unnecessary privileged access..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.