CVE-2021-27102: Accellion FTA OS command injection via local web service call

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe vulnerability allows OS command execution on a file transfer appliance and is in CISA KEV with documented ransomware campaign use, though it requires local access rather than being remotely exploitable.

What it is

Accellion FTA 9_12_411 and earlier allows OS command execution through a local web service call, classified as CWE-78 command injection. The flaw is fixed in FTA_9_12_416 and later. Because it is in a widely deployed file transfer appliance and has been exploited in the wild, it matters for any organization still running the affected versions.

Impact

An attacker who can reach the local web service can execute arbitrary operating system commands on the appliance, leading to full compromise of the host and any data it handles.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker needs a foothold or local access to the appliance to invoke the vulnerable web service call. It is not described as remotely reachable without such access.

Exploitation

CVE-2021-27102 is listed in CISA KEV with a due date of 2021-11-17 and is flagged for known ransomware campaign use. EPSS 30-day probability is about 3.65 percent (89th percentile), and the vendor advisory reference is marked as a broken link.

What to do

• Upgrade Accellion FTA to FTA_9_12_416 or later as the primary fix.
• If the appliance cannot be patched immediately, isolate it from untrusted networks and restrict local access to the web service.
• Monitor and restrict accounts and processes that can make local web service calls on the appliance.
• Treat any unpatched FTA instance as compromised and perform incident response, given known ransomware use.
• Retire or replace end-of-life FTA deployments that cannot be brought to a supported version.

Detection

• Audit FTA versions in the environment and alert on any host below FTA_9_12_416.
• Monitor appliance logs for unexpected local web service calls and child processes spawned by the web service.
• Hunt for suspicious command execution or new processes on FTA hosts, especially around data staging or exfiltration.
• Correlate FTA host activity with outbound connections and file access anomalies consistent with ransomware staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.