CVE-2021-27104 is a critical OS command injection vulnerability (CVSS 9.8) affecting Accellion FTA versions 9_12_370 and earlier, allowing unauthenticated attackers to execute arbitrary commands via crafted POST requests to administrative endpoints. This flaw is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, notably by ransomware groups, and has garnered significant community attention and media coverage, despite a lack of public exploit code in common repositories.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9_12_370CPE matchmatch criteria | cpe:2.3:a:accellion:fta:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.