CVE-2021-27103: Accellion FTA SSRF in wmProgressstat.html

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCritical CVSS 9.8, no authentication required, KEV-listed with known ransomware use, and confirmed in-the-wild exploitation.

What it is

Accellion FTA 9_12_411 and earlier is vulnerable to server-side request forgery through a crafted POST request to wmProgressstat.html. The flaw is remotely reachable without authentication and carries a critical CVSS score of 9.8, making it a serious risk for internet-facing FTA deployments.

Impact

An attacker can force the server to make requests to arbitrary destinations, enabling access to internal services and data that should not be externally reachable. The CVSS vector indicates high confidentiality, integrity and availability impact.

Attack surface

Reached over the network via a crafted POST to wmProgressstat.html; the CVSS vector shows no privileges or user interaction required. Any internet-exposed FTA instance running an affected version is in scope.

Exploitation

Listed in CISA KEV with known ransomware campaign use, and EPSS 30-day probability is about 11.4 percent (95.8th percentile), indicating observed exploitation in the wild.

What to do

• Upgrade FTA to 9_12_416 or later as the vendor-directed fix.
• If immediate patching is not possible, remove FTA from direct internet exposure or restrict access to trusted networks.
• Monitor and restrict outbound traffic from FTA hosts to only required destinations.
• Review FTA logs for suspicious POST requests to wmProgressstat.html and unexpected outbound connections.
• Treat any unpatched, internet-facing FTA host as potentially compromised and investigate accordingly.

Detection

• Search web and proxy logs for POST requests to wmProgressstat.html, especially from unexpected sources.
• Monitor FTA host outbound connections to internal RFC1918 addresses or unusual external endpoints.
• Alert on FTA processes initiating network connections outside normal baseline behavior.
• Correlate FTA host activity with known post-exploitation or ransomware indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.