---
id: "CVE-2021-27103"
kind: "vulnerability"
aliases: ["CVE-2021-27103"]
title: "Accellion FTA: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.11406
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Accellion FTA", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["accellion-fta", "exploited", "file-transfer", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["no-accellion-fta-deployed"]
published_at: "2021-02-16T21:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27103", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-27103", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27103", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Accellion FTA: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability

Accellion File Transfer Appliance (FTA) has a server-side request forgery flaw triggered by a crafted POST request to wmProgressstat.html. An unauthenticated attacker can make the server send requests to internal systems it can reach, and this flaw was exploited in the wild, including in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Accellion FTA affected ? fixed ?

## Fix

Apply the vendor updates per Accellion instructions (CISA required action); the fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27103
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-27103
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-27103

## From the sources

Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_