Live › vulnerability › CVE-2021-27103
Go to dashboardAccellion File Transfer Appliance (FTA) has a server-side request forgery flaw triggered by a crafted POST request to wmProgressstat.html. An unauthenticated attacker can make the server send requests to internal systems it can reach, and this flaw was exploited in the wild, including in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Accellion FTA | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the vendor updates per Accellion instructions (CISA required action); the fixed version is not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2021-27103")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.