CVE-2021-27104

What it actually does

CVE-2021-27104 is an unauthenticated remote OS command injection vulnerability in Accellion FTA 9_12_370 and earlier. A crafted POST request to certain administrative endpoints can cause the appliance to execute attacker-controlled operating system commands in the context of the FTA application or web server process. Because the issue is network-reachable, low-complexity, and requires no user interaction or authentication, successful exploitation can lead to full compromise of the file transfer appliance, including arbitrary command execution, web shell deployment, credential and file theft, tampering, and service disruption.

Why it matters to the business

A compromised Accellion FTA appliance can expose sensitive files being transferred through the platform, including regulated data, customer information, intellectual property, legal documents, and business records. This vulnerability is known to have been exploited in the wild and is listed in CISA KEV, with known ransomware and extortion-related use, so organizations should treat any exposed vulnerable FTA instance as a high-priority incident risk, not merely a patching task. Operational consequences may include data breach notification obligations, business partner exposure, interruption of managed file transfer services, legal and regulatory costs, and reputational harm.

How an attack unfolds

An attacker identifies an internet-facing Accellion FTA appliance running version 9_12_370 or earlier. The attacker sends a specially crafted unauthenticated POST request to vulnerable administrative functionality that improperly passes user-controlled input to the operating system shell. If exploitation succeeds, the appliance executes the supplied command. The attacker may then use command execution to enumerate the host, read configuration and transfer directories, retrieve stored files, dump credentials or session material, and write a web shell or other persistence mechanism. In observed real-world Accellion FTA exploitation campaigns, attackers used chained vulnerabilities and post-exploitation tooling to steal data from FTA appliances and support extortion activity. Because exploitation has been active in the wild for years, vulnerable or historically vulnerable systems should be investigated for prior compromise even if they have since been upgraded.

How to fix it

Upgrade Accellion FTA to FTA_9_12_380 or later immediately if the product remains in use. Because Accellion FTA is a legacy product, organizations should also plan migration to a supported secure file transfer platform where possible. If immediate upgrade or retirement is not possible, remove internet exposure, restrict access to trusted administrative networks through VPN or allowlisting, place the appliance behind protective controls, and disable or isolate vulnerable services. Rotate credentials, API keys, certificates, and secrets that may have been stored on or accessible from the appliance. Review and purge unauthorized files, scripts, web shells, and scheduled tasks. Given known exploitation and ransomware/extortion usage, perform incident response on any appliance that was exposed while running 9_12_370 or earlier rather than relying on patching alone.

How to confirm the fix worked

Confirm the installed Accellion FTA version is FTA_9_12_380 or later, or that the appliance has been fully decommissioned and is no longer reachable. Validate that administrative endpoints are not publicly accessible and are limited to approved management networks. Perform an external scan to confirm there are no exposed FTA services from the internet. Review vendor-provided update logs and appliance package/version information to ensure the upgrade completed successfully. Test compensating controls by verifying that unauthenticated requests to administrative paths are blocked or return only expected authorization errors. Conduct filesystem and log review to confirm there are no unexpected web-accessible scripts, recently modified application files, suspicious cron entries, or unexplained outbound connections.

Typical attack path

1. Scan the internet or known partner-facing infrastructure for Accellion FTA appliances.
2. Fingerprint the FTA version or infer vulnerability from exposed behavior and endpoint responses.
3. Send a crafted POST request to a vulnerable administrative endpoint to inject an operating system command.
4. Execute reconnaissance commands to determine user context, filesystem layout, appliance version, and reachable data stores.
5. Access or stage sensitive transferred files, configuration files, credentials, or application secrets.
6. Deploy a web shell, backdoor, or scheduled task for repeat access if write access is available.
7. Exfiltrate collected files or command output to attacker-controlled infrastructure.
8. Use stolen data for extortion, credential reuse, partner compromise, or follow-on intrusion activity.

How to detect it

Investigate web, application, reverse proxy, WAF, firewall, EDR, and system logs for evidence of unauthenticated POST requests to Accellion FTA administrative endpoints followed by command execution, unusual file access, or outbound connections. Focus on the period before upgrade to FTA_9_12_380 or later and any time the appliance was exposed to the internet. Look for unexpected child processes spawned by the web server or FTA application, such as shell interpreters, archive tools, network utilities, or scripting runtimes. Review web-accessible directories for new or modified scripts, web shells, or files with unusual timestamps. Examine transfer logs for abnormal bulk downloads, access to unusual file sets, downloads from unfamiliar IP addresses, or access outside normal business patterns. Check DNS, proxy, and firewall logs for unexpected outbound traffic from the appliance to external hosts, especially shortly after suspicious POST requests. Because this vulnerability was used in real-world Accellion FTA data theft and extortion campaigns, correlate exploitation attempts with signs of staging archives, compressed file creation, credential access, and deletion or tampering with logs.

• POST requests to Accellion FTA administrative endpoints from unauthenticated or unfamiliar external IP addresses
• unexpected child process spawned by web server or FTA application: /bin/sh
• unexpected child process spawned by web server or FTA application: /bin/bash
• unexpected child process spawned by web server or FTA application: cmd.exe
• unexpected child process spawned by web server or FTA application: powershell.exe
• unexpected child process spawned by web server or FTA application: wget
• unexpected child process spawned by web server or FTA application: curl
• unexpected child process spawned by web server or FTA application: nc
• unexpected child process spawned by web server or FTA application: netcat
• unexpected child process spawned by web server or FTA application: perl
• unexpected child process spawned by web server or FTA application: python
• unexpected child process spawned by web server or FTA application: tar
• unexpected child process spawned by web server or FTA application: gzip
• unexpected child process spawned by web server or FTA application: zip
• unexpected child process spawned by web server or FTA application: 7z
• FTA_9_12_370
• FTA_9_12_380
• Accellion FTA 9_12_370
• Accellion FTA 9_12_380
• outbound HTTP or HTTPS connection from Accellion FTA appliance immediately after an administrative POST request
• new or recently modified web-accessible script file on Accellion FTA appliance
• unexpected archive files created on Accellion FTA appliance: .tar
• unexpected archive files created on Accellion FTA appliance: .tar.gz
• unexpected archive files created on Accellion FTA appliance: .zip
• unexpected archive files created on Accellion FTA appliance: .7z

What your security team should do

• Treat any internet-exposed Accellion FTA 9_12_370 or earlier system as potentially compromised due to known in-the-wild exploitation and CISA KEV listing.
• Upgrade to FTA_9_12_380 or later, or preferably retire/migrate away from legacy Accellion FTA if still present.
• Immediately remove direct internet exposure and restrict access to trusted administrative networks while remediation and investigation are underway.
• Run incident response procedures on exposed appliances, including preservation of logs, forensic imaging where possible, web shell hunting, and review of transferred file access history.
• Rotate credentials, certificates, API tokens, and any secrets stored on or handled by the FTA appliance.
• Search historical proxy, WAF, web server, EDR, DNS, and firewall logs for suspicious POST requests, command execution artifacts, unexpected outbound traffic, and anomalous file downloads.
• Assess whether sensitive files were accessed or exfiltrated and prepare legal, privacy, and partner notification workflows if evidence supports data exposure.
• Prioritize remediation ahead of normal patch cycles because the vulnerability is KEV-listed, remotely exploitable without authentication, and associated with ransomware/extortion activity.