Actively exploited · Published Feb 16, 2021 · Assigned by mitre

CVE-2021-27104

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity OS command injection in FTA from Accellion. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 56.7% (higher than 99.1% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)56.7%top 0.9% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.accellion.com/products/fta/ x_refsource_MISC
https://github.com/accellion/CVEs/blob/main/CVE-2021-27104.txt x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27104 government-resource