{"id":"CVE-2021-27103","kind":"vulnerability","aliases":["CVE-2021-27103"],"related":[],"title":"Accellion FTA: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability","description":"Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Accellion File Transfer Appliance (FTA) has a server-side request forgery flaw triggered by a crafted POST request to wmProgressstat.html. An unauthenticated attacker can make the server send requests to internal systems it can reach, and this flaw was exploited in the wild, including in ransomware campaigns.","severity":"critical","cvss":9.8,"epss":0.11406,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Accellion FTA","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["accellion-fta","exploited","file-transfer","ransomware","self-hosted","vendor"],"not_affected_if":["no-accellion-fta-deployed"],"how_to_check":null,"fix":"Apply the vendor updates per Accellion instructions (CISA required action); the fixed version is not stated in the sources.","status":"open","published_at":"2021-02-16T21:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:16+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:37:16Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor updates per Accellion instructions (CISA required action); the fixed version is not stated in the sources.\nunknown","reach":"internet","impact":"medium","summary":"Accellion File Transfer Appliance (FTA) has a server-side request forgery flaw triggered by a crafted POST request to wmProgressstat.html. An unauthenticated attacker can make the server send requests to internal systems it can reach, and this flaw was exploited in the wild, including in ransomware campaigns.","category":"vendor","who_cares":["accellion-fta","self-hosted","file-transfer"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reaches internal network services through the appliance, enabling further compromise.","analyst_note":"Find the vendor advisory and fixed FTA version, and a check for the wmProgressstat.html exploit pattern in access logs; sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-accellion-fta-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000481,"input_tokens":2839,"output_tokens":394,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the vendor advisory and fixed FTA version, and a check for the wmProgressstat.html exploit pattern in access logs; sources give neither.","search":"'-2021':13A,16A '-27103':14A,17A 'accellion':1A,3A,18A,21B,32B,80C 'accellion-fta':20B 'action':101C 'appli':102C 'applianc':35B 'attack':55B 'campaign':79B 'cisa':99C 'contain':82C 'craft':48B,94C 'cve':12A,15A 'exploit':23B,72B,91C 'file':25B,33B 'file-transf':24B 'flaw':44B,70B 'forgeri':9A,43B,88C 'fta':2A,4A,19A,22B,36B,81C 'host':30B 'includ':76B 'instruct':106C 'intern':63B 'make':57B 'per':104C 'post':49B,95C 'ransomwar':27B,78B 'reach':67B 'request':8A,42B,50B,61B,87C,96C 'requir':100C 'self':29B 'self-host':28B 'send':60B 'server':6A,40B,59B,85C 'server-sid':5A,39B,84C 'side':7A,41B,86C 'ssrf':10A,89C 'system':64B 'transfer':26B,34B 'trigger':45B 'unauthent':54B 'updat':103C 'vendor':31B,105C 'via':92C 'vulner':11A,90C 'wild':75B 'wmprogressstat.html':52B,98C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-02-16T21:15:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-27103","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27103","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2021-27103","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-27103","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-27103","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27103","severity":null,"published_at":"2021-02-16T21:15:13+00:00","modified_at":"2026-06-17T03:44:18+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}