CVE-2009-4647: Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows...

Security readout for executives and security teams

This CVE describes an XSS flaw in Accellion Secure File Transfer Appliance before 7_0_296. An attacker could place script or HTML in a username value that may run when an administrator views audit logs. The main business risk is compromise of an administrator’s browser session or misleading log content. Exposure is most likely in legacy Accellion Secure File Transfer Appliance deployments running versions before 7_0_296. Internet exposure is not proven by the sources; the vulnerable path involves administrator audit-log viewing after attacker-controlled username data is recorded. Treat this as a legacy appliance hygiene issue with administrator-impact potential. It is not supported by provided evidence of active exploitation, but affected file-transfer appliances often handle sensitive data and should be inventoried, version-checked, and remediated if still present. Mitigation focus: Identify any Accellion Secure File Transfer Appliance instances and their exact versions.; Prioritize upgrade review for appliances earlier than 7_0_296.; Check Accellion or successor vendor guidance for supported remediation steps..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.