CVE‑2021‑27101: Accellion FTA SQL Injection via Host Header
What It Is – Accellion File Transfer Appliance (FTA) contains a SQL injection flaw that can be triggered by sending a crafted Host header to the document_root.html endpoint.
Exploitability – The vulnerability is publicly disclosed, has a CVSS v3.1 base score of 9.8 (Critical), and proof‑of‑concept exploits are available.
Affected Products – Accellion FTA (all supported versions prior to the vendor’s security patch).
Why It Matters for Trust & Control Assurance
- Application security controls (input validation, secure coding) are a core control objective that maps to dozens of framework requirements (e.g., NIST CSF 2.0, ISO 27001, SOC 2).
- An unpatched FTA leaves organizations without defensible evidence that they have mitigated injection risks, a gap auditors will flag during security‑risk assessments.
- Continuous monitoring of vendor‑supplied patches and evidence of remediation feeds directly into a trustworthy audit trail that enterprise buyers now demand.
Recommended Actions
- Apply Accellion’s security patch immediately and verify the fix in a staging environment.
- Update web‑application firewalls (WAF) to block malicious
Hostheader patterns. - Document the remediation (patch version, test results, WAF rule change) in your control evidence repository.
- Integrate vulnerability scanning of FTA into your continuous monitoring pipeline to capture future findings as audit‑ready evidence.
Source: CISA KEV – CVE‑2021‑27101