Security readout for executives and security teams
Plain-English summary
CVE-2021-27101 is a critical Accellion FTA flaw that can let an unauthenticated attacker interfere with the appliance through SQL injection. CISA lists it as known exploited, so this is not theoretical. Any remaining legacy FTA deployment at version 9_12_370 or earlier should be treated as urgent.
Executive priority
Prioritize immediately. This is a critical, remotely reachable vulnerability in a file-transfer appliance class, and CISA confirms known exploitation. Leadership should require rapid asset discovery, version confirmation, remediation, and compromise review.
Technical view
Accellion FTA 9_12_370 and earlier has SQL injection through a crafted Host header in requests to document_root.html. The CVSS 3.1 score is 9.8: network exploitable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. The stated fixed version is FTA_9_12_380 and later.
Likely exposure
Exposure is most likely where Accellion FTA is deployed, especially if internet reachable and running 9_12_370 or earlier. The source bundle does not provide CPEs or detailed supported-product inventory, so organizations should verify appliance presence and exact version directly.
Exploitation context
CISA KEV inclusion supports known exploitation. The provided sources do not include exploit timing, actor attribution, target sectors, indicators of compromise, or detailed attack chains. Treat exposed vulnerable FTA systems as potentially compromised until checked.
Researcher notes
Core facts are strong: vendor-named product, vulnerable and fixed versions, attack vector, CVSS, and KEV status. Gaps remain: affected metadata in the bundle is sparse, no CWE is listed, and no public indicators or vendor mitigation details are included beyond the fixed version.
Mitigation direction
- Upgrade Accellion FTA to FTA_9_12_380 or later.
- Check current vendor guidance before making operational changes.
- Restrict external access to any FTA system until remediated.
- Retire unsupported or legacy FTA instances where feasible.
- Investigate vulnerable systems for possible compromise.
Validation and detection
- Inventory all Accellion FTA appliances and externally exposed hosts.
- Confirm installed FTA version is later than 9_12_370.
- Review logs for document_root.html requests with abnormal Host headers.
- Check CISA KEV status for remediation prioritization.
- Document remediation evidence and residual exposure.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-27101 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.accellion.com/products/fta/CVE reference · x_refsource_MISC
- https://github.com/accellion/CVEs/blob/main/CVE-2021-27101.txtCVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27101CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.