EXPOSURES › CVE-2021-27104
CVE-2021-27104
CRITICAL ⌖ ON CISA KEV · EXPLOITEDAccellion FTA's OS command injection vulnerability allowed attackers to execute arbitrary commands, leading to data exfiltration and ransomware attacks.
A command injection vulnerability in Accellion FTA allowed attackers to execute arbitrary OS commands via crafted POST requests, resulting in data breaches and ransomware infections. DIB organizations using FTA face significant compliance risks (NIST 800-171) and potential data exposure; immediate patching and security posture review are critical.
Shame score — The vulnerability was actively exploited in ransomware attacks, indicating a severe lack of security controls and a significant operational impact.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
"Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints."
"CISA Adds Four Known Exploited Vulnerabilities to Catalog"
"Vulnerability Database | SentinelOne"
"CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws."
"CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks."
| PRODUCT | STATUS |
|---|---|
| Kiteworks Federal Cloud Accellion USA, LLC. |
Authorized |