CVE-2021-27101: Accellion FTA SQL injection via crafted Host header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, plus CISA KEV listing and documented ransomware campaign use, make this a top-priority patch.

What it is

Accellion FTA 9_12_370 and earlier is affected by SQL injection through a crafted Host header in a request to document_root.html. The flaw is remotely reachable without authentication and carries a critical CVSS score, making it a serious risk for internet-facing FTA deployments.

Impact

An attacker can inject SQL through the Host header, potentially reading or modifying backend data and, given the critical integrity and availability ratings, disrupting the application. The record does not detail the exact database contents exposed.

Attack surface

Reached over the network via an HTTP request to document_root.html with a crafted Host header. The CVSS vector shows no privileges required and no user interaction, so it is unauthenticated and remotely triggerable.

Exploitation

Listed in CISA KEV with known ransomware campaign use, and EPSS 30-day probability is about 6 percent (92.9th percentile). Reference tags are vendor advisory, third-party advisory and US government resource; no public exploit code tag is present.

What to do

• Upgrade FTA to 9_12_380 or later, the fixed version named in the record.
• If immediate upgrade is not possible, restrict network access to FTA management and document_root endpoints to trusted sources.
• Validate and normalize the Host header at the reverse proxy or web server before it reaches FTA.
• Monitor vendor and CISA KEV guidance for this CVE and apply the required action.
• Treat any FTA host as potentially compromised and review it for signs of intrusion.

Detection

• Search web and proxy logs for requests to document_root.html with unusual or malformed Host header values.
• Look for SQL metacharacters or injection patterns in Host header fields in HTTP request logs.
• Alert on unexpected outbound connections or file activity from FTA servers consistent with post-exploitation.
• Correlate FTA access logs with authentication and process events around the same timeframe.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.