CVE-2021-27104: Accellion FTA OS command injection in admin endpoints

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution on an internet-facing appliance, listed in KEV with known ransomware use and very high EPSS.

What it is

Accellion FTA 9_12_370 and earlier allows OS command execution through a crafted POST request to various admin endpoints. The flaw is an unauthenticated network-reachable command injection, so a successful request can run arbitrary commands on the appliance. It matters because FTA is an internet-facing file transfer system and this issue was exploited in real campaigns.

Impact

An attacker can execute arbitrary operating system commands on the FTA server, leading to full compromise of the appliance and any data or credentials it holds.

Attack surface

Reached over the network via crafted POST requests to admin endpoints; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Listed in CISA KEV with known ransomware campaign use, and EPSS shows a high 30-day exploitation probability (0.56686, 99th percentile).

What to do

• Upgrade to FTA_9_12_380 or later as instructed by the vendor.
• If the appliance cannot be patched immediately, isolate or take it offline, since it is end-of-life and internet-facing.
• Restrict network access to FTA admin endpoints to trusted management networks only.
• Rotate credentials and secrets stored or processed by the FTA server after any suspected exposure.
• Monitor vendor and CISA guidance for follow-on FTA vulnerabilities used in the same campaign.

Detection

• Review web server and FTA logs for crafted POST requests to admin endpoints, especially unusual command or shell metacharacters.
• Alert on unexpected child processes spawned by the FTA web service (for example shells or system utilities).
• Hunt for outbound connections or file writes from the FTA host that do not match normal file transfer behavior.
• Correlate FTA host activity with known post-exploitation and ransomware precursor indicators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.