OS Command Injection in Accellion FTA (CVE‑2021‑27104) Threatens Enterprise File Transfers
What It Is — Accellion File Transfer Appliance (FTA) contains an OS command‑injection flaw in several admin endpoints. A crafted POST request can be interpreted by the underlying operating system, allowing an attacker to execute arbitrary commands.
Exploitability — Publicly disclosed with a proof‑of‑concept. CVSS v3.1 base score 9.8 (Critical). No large‑scale exploitation reported yet, but the attack vector is trivial for a knowledgeable adversary.
Affected Products — All Accellion FTA releases prior to the vendor’s March 2022 security update.
Why It Matters for Trust & Control Assurance
- Highlights the necessity of continuous vulnerability monitoring and documented patching to satisfy the secure configuration management control objective, which maps to many frameworks (e.g., NIST CSF, ISO 27001).
- Provides auditors with concrete remediation evidence (patch logs, configuration baselines) that can be presented as defensible proof of due‑diligence.
- Reinforces the importance of an up‑to‑date third‑party asset inventory, a cornerstone of supply‑chain risk assurance.
Recommended Actions
- Identify every Accellion FTA instance and confirm the installed version.
- Apply the March 2022 security update immediately; retain the patch‑install logs.
- Record the remediation activity in your control‑mapping repository and retain evidence for audit trails.
Source: CISA KEV – CVE‑2021‑27104