CVE-2021-27103

What it actually does

CVE-2021-27103 is an unauthenticated server-side request forgery vulnerability in Accellion FTA 9_12_411 and earlier. A remote attacker can send a crafted POST request to wmProgressstat.html that causes the FTA appliance to initiate attacker-controlled requests from the server side. Because FTA commonly has privileged access to internal file-transfer workflows, backend services, and sensitive stored data, successful exploitation can expose internal network resources, support data theft, and, when chained with other Accellion FTA vulnerabilities, enable broader compromise of the appliance. The CVSS 9.8 rating reflects network reachability, no required authentication, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

An exposed vulnerable Accellion FTA appliance can become a path for theft of sensitive transferred files and internal data, disruption of secure file-transfer operations, and follow-on extortion. This vulnerability is listed in CISA KEV, has documented exploitation in the wild, and is associated with ransomware/extortion activity, so unremediated systems should be treated as high-risk even though the vulnerability is older. Organizations that used Accellion FTA for regulated, customer, partner, legal, financial, or healthcare file exchange may face breach notification, contractual, legal, and reputational consequences if exploitation occurred.

How an attack unfolds

An attacker first identifies an internet-accessible Accellion FTA instance running a vulnerable release. They then send a crafted unauthenticated POST request to the wmProgressstat.html endpoint, abusing the SSRF flaw to make the appliance issue server-side requests under its own network context. In real-world campaigns, this vulnerability was not typically used in isolation; attackers chained Accellion FTA flaws to gain access to sensitive file-transfer data and, in some cases, deploy tooling or web-accessible artifacts used for collection and exfiltration. Because this vulnerability is KEV-listed, exploited in the wild, and associated with ransomware/extortion campaigns, any vulnerable or historically exposed FTA instance should be investigated for prior compromise, not merely patched.

How to fix it

Upgrade Accellion FTA to FTA_9_12_416 or later, as the description identifies FTA 9_12_411 and earlier as affected and FTA_9_12_416 and later as fixed. If FTA is still in use, strongly consider migration to a supported replacement platform because legacy FTA appliances have a history of actively exploited critical vulnerabilities. Restrict internet exposure to only required trusted networks, place the appliance behind a VPN or access gateway where feasible, and block unauthenticated external access to legacy FTA endpoints. Rotate credentials, API keys, certificates, and partner access tokens that may have transited or been stored on the appliance. If the appliance was exposed before remediation, perform incident response review for data access and exfiltration rather than assuming upgrade alone resolves the risk.

How to confirm the fix worked

Confirm the running Accellion FTA version is FTA_9_12_416 or later and that no FTA 9_12_411 or earlier appliances remain reachable. From an external vantage point, verify that /wmProgressstat.html is no longer publicly reachable or does not exhibit vulnerable behavior. Review load balancer, reverse proxy, WAF, and web server logs to confirm that unauthenticated POST requests to wmProgressstat.html are blocked or absent after remediation. Validate network segmentation by confirming the appliance cannot initiate unnecessary outbound requests to internal services or arbitrary internet destinations. For retired systems, verify DNS, firewall, NAT, and asset inventory records no longer expose the legacy FTA service.

Typical attack path

1. Identify an internet-facing Accellion FTA appliance.
2. Fingerprint the appliance version or confirm the presence of vulnerable FTA endpoints.
3. Send a crafted unauthenticated POST request to /wmProgressstat.html.
4. Abuse server-side request behavior to reach internal or local resources from the appliance context.
5. Chain with additional FTA weaknesses or attacker tooling to access file-transfer metadata or stored files.
6. Stage collected data or generated artifacts on the appliance or attacker-controlled infrastructure.
7. Exfiltrate sensitive files and use the access for extortion, ransomware-related pressure, or further intrusion activity.

How to detect it

Investigate web access logs, reverse proxy logs, WAF logs, load balancer logs, FTA appliance logs, authentication logs, file-transfer audit logs, endpoint telemetry from the appliance, and egress network logs. Look for unauthenticated POST requests to /wmProgressstat.html, unusual spikes in requests to legacy FTA endpoints, requests from unfamiliar external IP addresses, and access patterns followed by file enumeration or large downloads. Review the appliance filesystem for recently modified web-accessible files, unexpected scripts, staged archives, compressed files, or temporary files created around suspicious request times. Examine outbound network connections from the FTA appliance to unusual internal addresses, metadata services, localhost-only services, or unknown internet hosts. Because this vulnerability was exploited in ransomware/extortion activity, also look for evidence of bulk file access, unusual administrative actions, abnormal database or file index queries, and exfiltration to unfamiliar destinations. Correlate any findings with the known exposure period before upgrade to FTA_9_12_416 or later.

• POST /wmProgressstat.html
• /wmProgressstat.html
• wmProgressstat.html
• FTA_9_12_411
• FTA_9_12_416

What your security team should do

• Treat any vulnerable or historically internet-exposed Accellion FTA instance as a potential compromise because this issue is CISA KEV-listed, exploited in the wild, and associated with ransomware/extortion activity.
• Upgrade immediately to FTA_9_12_416 or later, or decommission/migrate the appliance if it cannot be upgraded.
• Search historical web, proxy, WAF, load balancer, and appliance logs for POST requests to /wmProgressstat.html, especially from unknown external IP addresses.
• Run a focused compromise assessment for suspicious files, web-accessible artifacts, unexpected processes, unusual outbound connections, and evidence of file enumeration or bulk downloads.
• Rotate credentials and secrets associated with FTA users, administrators, service accounts, certificates, and partner integrations.
• Review data handled by the appliance during the exposure window to determine whether breach notification, partner notification, or legal review is required.
• Add compensating controls: restrict source IPs, enforce VPN or private access, monitor outbound connections, and alert on legacy FTA endpoint access attempts.