--- title: "Accellion vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/accellion type: vendor description: "Accellion has 126 published CVEs, 4 in CISA KEV and 32 with public exploits." updated: 2026-09-30 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Accellion vulnerabilities - **Published CVEs:** 126 - **In CISA KEV:** 4 - **With a public exploit:** 32 - **With a patch:** 91 - **Average CVSS:** 7.4 - **CVEs in the last two years:** 84 - **First CVE:** 2008-08-27 - **Latest CVE:** 2026-09-30 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 24 | | High | 58 | | Medium | 43 | | Low | 1 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [kiteworks](https://radicalnotion.ai/vendor/accellion/kiteworks) | 83 | | [File Transfer Appliance](https://radicalnotion.ai/vendor/accellion/file-transfer-appliance) | 20 | | [secure file transfer appliance](https://radicalnotion.ai/vendor/accellion/secure-file-transfer-appliance) | 7 | | [FTA](https://radicalnotion.ai/vendor/accellion/fta) | 6 | | [kiteworks managed file transfer](https://radicalnotion.ai/vendor/accellion/kiteworks-managed-file-transfer) | 4 | | [kiteworks appliance](https://radicalnotion.ai/vendor/accellion/kiteworks-appliance) | 3 | | [FTP Server](https://radicalnotion.ai/vendor/accellion/ftp-server) | 2 | | [Accellion FTA](https://radicalnotion.ai/vendor/accellion/accellion-fta) | 2 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 18 | | [CWE-918](https://radicalnotion.ai/cwe/cwe-918) | Server-Side Request Forgery (SSRF) | 10 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 9 | | [CWE-78](https://radicalnotion.ai/cwe/cwe-78) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 8 | | [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 7 | | [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 7 | | [CWE-306](https://radicalnotion.ai/cwe/cwe-306) | Missing Authentication for Critical Function | 6 | | [CWE-93](https://radicalnotion.ai/cwe/cwe-93) | Improper Neutralization of CRLF Sequences ('CRLF Injection') | 4 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [cisa-cg](https://radicalnotion.ai/cna/cisa-cg) | 61 | | [mitre](https://radicalnotion.ai/cna/mitre) | 29 | | [GitHub\_M](https://radicalnotion.ai/cna/github-m) | 23 | | [certcc](https://radicalnotion.ai/cna/certcc) | 11 | | [rapid7](https://radicalnotion.ai/cna/rapid7) | 2 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2020 | 2 | | 2021 | 8 | | 2022 | 1 | | 2023 | 0 | | 2024 | 0 | | 2025 | 5 | | 2026 | 79 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-102105 | Kiteworks Email Protection Gateway server-side request forgery | critical | 9.1 | 0.5% | No | 2026-09-30 | | CVE-2026-102106 | Kiteworks Email Protection Gateway improper authentication | critical | 9.1 | 1.1% | No | 2026-09-30 | | CVE-2026-102107 | Kiteworks Core user impersonation in a file-request feature | medium | 4.6 | 0.2% | No | 2026-09-30 | | CVE-2026-102108 | Kiteworks Email Protection Gateway deserialization of untrusted data | high | 7.2 | 1.5% | No | 2026-09-30 | | CVE-2026-102109 | Kiteworks Secure Data Forms SQL injection | high | 7.1 | 0.4% | No | 2026-09-30 | | CVE-2026-102110 | Missing authentication on a Kiteworks appliance setup function | medium | 5.9 | 0.2% | No | 2026-09-30 | | CVE-2026-102111 | Kiteworks Core Improper Validation of Specified Quantity in Input | medium | 4.9 | 0.2% | No | 2026-09-30 | | CVE-2026-102112 | Kiteworks Core Local Privilege Escalation | high | 7.8 | 0.4% | No | 2026-09-30 | | CVE-2026-102113 | Kiteworks Core Local Privilege Escalation | high | 7.8 | 0.4% | No | 2026-09-30 | | CVE-2026-102114 | Kiteworks Core OS Command Injection | high | 7.2 | 3.1% | No | 2026-09-30 | | CVE-2026-102115 | Kiteworks Core Authentication Bypass in the Password Reset Workflow | critical | 9.8 | 1.0% | No | 2026-09-30 | | CVE-2026-102116 | Kiteworks Email Protection Gateway Path Traversal | high | 7.2 | 2.0% | No | 2026-09-30 | ## Frequently asked questions ### How many CVEs does Accellion have? Accellion has 126 published CVE records since 2008, including 84 in the last two years. ### How many Accellion CVEs are in CISA KEV? 4 of Accellion's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Which Accellion products have the most CVEs? The Accellion products with the most published CVEs are kiteworks, File Transfer Appliance, secure file transfer appliance, FTA, kiteworks managed file transfer. ### What are the most common weakness types in Accellion CVEs? Accellion's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-918 (Server-Side Request Forgery (SSRF)), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')). ### Are there public exploits for Accellion vulnerabilities? Yes — 32 of Accellion's CVEs have a known public exploit. ### How many critical Accellion vulnerabilities are there? Accellion has 24 critical and 58 high-severity CVEs. ### What is the average severity of Accellion CVEs? The average CVSS base score across Accellion's scored CVEs is 7.4. ## Related vendors - [Cap-go](https://radicalnotion.ai/vendor/cap-go) (127 CVEs) - [carmelo](https://radicalnotion.ai/vendor/carmelo) (127 CVEs) - [ChurchCRM](https://radicalnotion.ai/vendor/churchcrm) (127 CVEs) - [Axis Communications](https://radicalnotion.ai/vendor/axis) (126 CVEs) - [Johnson Controls](https://radicalnotion.ai/vendor/johnson-controls) (126 CVEs) - [libming](https://radicalnotion.ai/vendor/libming) (126 CVEs) - [swftools](https://radicalnotion.ai/vendor/swftools) (126 CVEs) - [Philips](https://radicalnotion.ai/vendor/philips) (125 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/accellion). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.