CVE-2021-27103: Accellion FTA Server‑Side Request Forgery (SSRF) Vulnerability
What It Is — A server‑side request forgery flaw in Accellion’s File Transfer Appliance (FTA) that can be triggered with a crafted POST to wmProgressstat.html. The flaw allows an attacker to make the appliance issue arbitrary HTTP requests to internal services.
Exploitability — Publicly disclosed with a proof‑of‑concept; CVSS v3.1 base score 8.8 (High). No widespread active exploit reported, but the attack vector is straightforward for any unauthenticated network‑facing endpoint.
Affected Products — Accellion FTA (both on‑premises and cloud deployments).
Why It Matters for Trust & Control Assurance
- Network‑segmentation control – SSRF bypasses expected isolation, eroding the audit evidence that internal services are protected.
- Configuration‑change monitoring – The flaw often stems from unchecked request‑validation logic; continuous evidence of configuration hardening is essential.
- Enterprise buyer expectations – Buyers now request demonstrable, up‑to‑date controls for request validation and evidence that remediation is tracked in a trusted audit repository.
Recommended Actions
- Deploy Accellion’s security patch for CVE‑2021‑27103 without delay.
- Review inbound request handling; enforce strict URL whitelisting and network‑level egress restrictions.
- Capture remediation steps and configuration state in your Trust Center to provide audit‑ready evidence.
Source: CISA KEV – CVE‑2021‑27103