CVE-2021-27101

Accellion FTA is used to send and manage files. This vulnerability lets attackers trick the system into running database instructions they shouldn’t be able to run by sending a specially crafted network header. Think of it like adding a “hidden instruction” to the request message—if it’s accepted, the attacker can pull sensitive data and potentially disrupt your service.

This matters if your business runs Accellion FTA (FTA_9_12_370 or earlier) as a file-transfer/file-management system that’s reachable from other networks. It matters especially if attackers can reach the vulnerable page (document_root.html) on your server, since CISA lists it as being used in ransomware campaigns. Exposure is primarily a reachability problem: it’s a risk when the affected Accellion FTA is reachable from the network path an attacker can use to send requests.

This is RED because it has been confirmed in the real world (listed in CISA KEV and used in ransomware campaigns). Attackers are actively targeting internet-facing systems of this type, so waiting increases your chance of data theft and disruption.

1. Identify your exposure

   • Determine the exact Accellion FTA version you run.
   • Confirm whether it is FTA_9_12_370 or earlier.

2. Validate the fix target

   • The vendor-provided remediation indicates the fixed version is FTA_9_12_380 and later.

3. Upgrade to the fixed version (preferred remediation)

   • Follow the vendor’s update instructions referenced in the vendor guidance (see the vendor CVE guidance and the Accellion FTA product update page).
   • Upgrade to Accellion FTA FTA_9_12_380 (or later).
   • After upgrading, verify the running build/version is actually FTA_9_12_380+.

4. If you cannot upgrade immediately

   • Use the vendor’s interim guidance for mitigations tied to this CVE (the remediation page linked in the findings).
   • Reduce the attack surface while waiting (for example, ensure the system is not broadly exposed and only permitted traffic can reach the relevant web endpoints).

5. What to monitor after the change

   • Look for signs of unauthorized access around the timeframe of exposure (e.g., unusual access patterns, unexpected data downloads, or system changes).
   • Confirm that the application remains stable and that file-transfer operations continue normally post-upgrade.

Severity is effectively critical (SQL injection leading to high-impact consequences). The attack mechanism is SQL injection via a crafted Host header sent to document_root.html in Accellion FTA versions FTA_9_12_370 and earlier. This weakness has been confirmed for real-world abuse: it is listed in CISA KEV (added 2021-11-03) with a remediation due date of 2021-11-17, and it was used in ransomware campaigns (actor referenced in the findings: Cl0p). Public proof-of-concept exists (EXPLOIT card notes a public PoC on GitHub). Fix availability: vendor remediation indicates FTA_9_12_380 and later. Exploit maturity is high enough for real-world use (not just theoretical), and while EPSS was predicted at 5.9% with a rising trend, the KEV listing takes precedence for real-world urgency in this case. KEV here means the US CISA has validated that the vulnerability is being exploited in the wild, and organizations are expected to apply vendor fixes or equivalent mitigations.