CVE-2021-27103

accellion fta

Published 16 Feb 2021 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 17 Nov 2021 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.

References

github.com/accellion/CVEs/blob/main/CVE-2021-27103.txt · Broken Link, Product
www.accellion.com/products/fta/ · Product
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27103 · US Government Resource