CVE-2021-27102 is an OS command injection vulnerability affecting Accellion FTA versions 9_12_411 and earlier, allowing a local attacker to execute arbitrary commands via a web service call. This vulnerability carries a high CVSS score of 7.8, indicating a severe impact with high confidentiality, integrity, and availability compromise, requiring only local access and low attack complexity. It is actively exploited in the wild, notably by ransomware groups like Clop, and is listed in CISA's KEV catalog. Despite no public exploit code on platforms like Metasploit or ExploitDB, it has garnered significant community discussion and media coverage due to its active exploitation in ransomware campaigns.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9_12_411CPE matchmatch criteria | cpe:2.3:a:accellion:fta:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.