critical9.8Known exploited
CVE-2021-27104
Accellion FTA OS Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2021-11-17.
Apply updates per vendor instructions.
Impact
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Accellion | Fta | through 9_12_370 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://github.com/accellion/CVEs/blob/main/CVE-2021-27104.txt
- https://www.accellion.com/products/fta/
- https://github.com/accellion/CVEs/blob/main/CVE-2021-27104.txt
- https://www.accellion.com/products/fta/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27104