CVE-2021-27102

What it actually does

Accellion FTA 9_12_411 and earlier contains an operating system command injection flaw reachable through a local web service call. An attacker with low-privileged access, or an attacker who first chains another vulnerability to reach the local service, can cause the FTA appliance to execute arbitrary OS commands with the privileges of the vulnerable service. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the appliance, including file theft, payload staging, persistence, and service disruption.

Why it matters to the business

Compromise of an Accellion FTA appliance can expose sensitive files moving through the managed file transfer platform, interrupt file-transfer operations, and provide a foothold for broader intrusion activity. This vulnerability is listed in CISA KEV, has been exploited in the wild, and is associated with ransomware/extortion activity, so organizations that still operate affected FTA versions should treat exposure as urgent even though the EPSS score is modest and stable.

How an attack unfolds

An attacker first obtains local access to the Accellion FTA appliance or chains another flaw to make requests to the vulnerable local web service. The attacker crafts a request that places shell metacharacters or command syntax into a parameter handled unsafely by the service. The vulnerable component passes attacker-controlled input to the operating system, causing commands to run on the appliance. From there, the attacker can enumerate stored files, collect credentials or configuration data, write web shells or other tools, exfiltrate files, delete evidence, or use the appliance as a staging point for extortion and ransomware-related operations. Public reporting around the Accellion FTA exploitation campaign indicates attackers used chained vulnerabilities against FTA systems to steal data and support extortion activity, so exploitation should be investigated as potential data theft, not merely code execution.

How to fix it

Upgrade Accellion FTA to FTA_9_12_416 or later. Because Accellion FTA is a legacy product and has been heavily targeted, organizations should also evaluate migration away from FTA to a supported managed file transfer platform if they have not already done so. If immediate upgrade is not possible, isolate the appliance from untrusted networks, restrict administrative and service access to trusted management hosts, block unnecessary inbound and outbound connectivity, monitor for command execution and file-access anomalies, and rotate credentials or keys stored on or used by the appliance after remediation. Due to KEV status and known exploitation in ransomware/extortion campaigns, mitigation alone should be considered temporary.

How to confirm the fix worked

Confirm the appliance reports FTA_9_12_416 or later and that no remaining FTA 9_12_411 or earlier systems are reachable. Review package, appliance, and administrative version information rather than relying only on external banners. Verify network controls prevent untrusted access to management interfaces and local-service relay paths. After upgrade, run an authenticated vulnerability scan or configuration audit for the Accellion FTA version. Validate that web server, application, and system logs show no recent command-injection attempts, unexpected child processes from web/application services, suspicious file writes in web-accessible directories, or unexplained outbound connections.

Typical attack path

1. Identify an exposed or reachable Accellion FTA appliance running version 9_12_411 or earlier.
2. Gain the ability to reach the vulnerable local web service, either through local access or by chaining another FTA vulnerability.
3. Send a crafted local web service request containing OS command syntax in an input field processed by the vulnerable component.
4. Execute commands on the appliance under the service account context.
5. Enumerate appliance configuration, user data, transfer directories, and accessible files.
6. Stage tooling, write scripts or web-accessible files, or establish persistence if permissions allow.
7. Exfiltrate sensitive files and logs, then attempt cleanup or follow-on extortion activity.

How to detect it

Investigate as a potential appliance compromise and data-theft event. Review Accellion FTA application logs, local web service logs, web server access/error logs, authentication logs, operating system audit logs, shell history, cron/systemd entries, file integrity records, and network egress telemetry. Look for requests that include shell metacharacters, encoded command strings, or attempts to invoke interpreters and download utilities. Hunt for web/application service processes spawning shells or system utilities, unexpected files in web-accessible directories, recently modified scripts, unusual archive creation, large outbound transfers, and connections to unfamiliar external hosts. Because this flaw was part of broader Accellion FTA exploitation activity associated with extortion, correlate any command-execution evidence with file enumeration, compression, staging, and outbound data transfer events. Include a historical review back to the first possible exposure date because this vulnerability has been public and exploited for years.

• FTA_9_12_411
• FTA_9_12_416
• /bin/sh -c
• /bin/bash -c
• bash -c
• sh -c
• cmd=
• ;id
• ; whoami
• | whoami
• `whoami`
• $(whoami)
• curl http
• wget http
• nc -e
• ncat -e
• python -c
• perl -e
• chmod +x
• /tmp/
• /var/tmp/
• /dev/shm/
• tar czf
• gzip -c
• base64 -d
• nohup
• crontab -e
• /etc/cron.d/
• /home/httpd/html/
• about.html
• DEWMODE

What your security team should do

• Treat any affected Accellion FTA appliance as high priority because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and is associated with ransomware/extortion activity.
• Upgrade to FTA_9_12_416 or later, or decommission/migrate from Accellion FTA if the platform is no longer strategically supported.
• Perform threat hunting before and after remediation for evidence of command execution, web shells, suspicious file access, and data exfiltration from the appliance.
• Preserve relevant logs and forensic artifacts before rebuilding or decommissioning the appliance, especially web logs, application logs, shell history, cron entries, recently modified files, and outbound network records.
• Rotate credentials, API keys, certificates, and file-transfer secrets that were stored on or accessible from the FTA appliance.
• Review historical file-transfer activity for unusual bulk downloads, access to sensitive archives, or activity from unfamiliar IP addresses.
• Restrict FTA access to required networks only and block direct internet exposure wherever business requirements allow.
• Monitor for extortion notifications or leaked data references if sensitive files may have transited the appliance during the exposure window.