CVE-2021-27104criticalunder attackransomwareCWE-78

CVE-2021-27104

Published · Updated

Follow this CVE+ Monitor FTA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 57%
from disclosure to weapon
Published on NVDFeb 16
CISA KEV+260d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

Accellion FTA versions up to 9_12_370 have a critical flaw that allows attackers to run system commands by sending specially crafted requests to admin areas. This can give attackers complete control over the affected server.

Technical detail

OS command injection vulnerability in Accellion FTA ≤9_12_370 accessible via POST requests to admin endpoints. Attackers can execute arbitrary system commands with server-level privileges, requiring only network access to the vulnerable endpoint. Impact includes full system compromise and unauthorized access to sensitive data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a