CVE‑2021‑27102: Accellion FTA OS Command Injection Vulnerability
What It Is — Accellion File Transfer Appliance (FTA) contains an OS command‑injection flaw that can be triggered through a local web‑service call, allowing an attacker to execute arbitrary operating‑system commands on the underlying host.
Exploitability — The vulnerability is publicly disclosed, a proof‑of‑concept exists, and the CVSS v3.1 base score is 9.8 (Critical). No large‑scale exploit campaigns have been reported, but the severity and ease of exploitation demand immediate remediation.
Affected Products — All supported versions of Accellion FTA released before the vendor’s March 2022 security patch.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that can surface and remediate flaws in third‑party services before they become exploitable.
- Provides audit‑ready evidence that your organization actively monitors and patches external components, a key signal for regulators and enterprise buyers.
- Enables a defensible control‑mapping process: linking the remediation of this CVE to the control objective of “maintain an effective vulnerability‑management program” satisfies multiple frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6).
Recommended Actions
- Apply Accellion’s March 2022 patch or upgrade to a version where the issue is fixed.
- Verify remediation by scanning the appliance for the vulnerable endpoint and confirming the patch status.
- Update your vulnerability‑management program to include regular checks of third‑party file‑transfer solutions and capture remediation evidence in your control‑mapping repository.
Source: CISA KEV – CVE‑2021‑27102