CVE-2021-27103 — FTA
CRITICALCVE-2021-27103 is a critical-severity (CVSS 9.8) Server-Side Request Forgery (SSRF) vulnerability in accellion fta. It is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and has been used in ransomware campaigns — treat it as actively exploited and patch now. A fix is available — see the affected versions and patch details below.
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Exploitation Status
Actively exploited in the wild
- Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 — including use in ransomware campaigns. Federal agencies were required to remediate by 2021-11-17.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2021-27103.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2021-27103 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.
Description
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.
Affected Products
ftaaccellionResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Vendor / applianceDetect
Inventory every accellion fta deployment and check each version against the affected-products list above.
Fix
Apply the accellion fta security patch or hotfix for CVE-2021-27103 on the affected version, following the vendor advisory for your exact build.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2021-27103 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.