Accellion FTA Host Header SQL Injection Vulnerability (CVE-2021-27101) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAccellion FTA versions 9_12_370 and earlier
Unauthenticated remote attackers can execute arbitrary SQL commands via a crafted Host header, leading to sensitive data exposure or potential remote code execution (RCE)
Immediately upgrade Accellion FTA to version 9_12_380 or later and restrict external access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security update to upgrade the appliance to version 9_12_380 or later immediately.
# Example command to apply system updates via FTA administrative CLI
update_system --apply-patch
show_version2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, configure a Web Application Firewall (WAF) or a reverse proxy to drop requests with unrecognized or malformed Host headers.
# Nginx configuration to drop requests with undefined Host headers
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 444; # Drop connection immediately
}3. Log Audit & IoC Verification Commands
Inspect web server access logs for suspicious requests targeting document_root.html containing SQL syntax.
# Search access logs for SQL injection patterns targeting document_root.html
grep -i 'document_root.html' /var/log/apache2/access.log | grep -E '(select|union|insert|update|delete|--|#)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the Accellion File Transfer Appliance (FTA) during the processing of requests to document_root.html. The root cause is the lack of proper validation and sanitization of the HTTP Host header provided by the client, which is directly concatenated into internal SQL queries.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious HTTP request targeting document_root.html with SQL injection payloads embedded within the Host header. When the FTA application processes this request, the database executes the injected SQL commands. This allows the attacker to bypass authentication, extract sensitive session tokens, user credentials, and file metadata, or potentially write malicious files to the web root to achieve remote code execution.
3. Infrastructure & Business Impact
Since Accellion FTA is designed for secure, large-scale file transfers, exploitation of this vulnerability poses an extreme risk of intellectual property theft and regulatory non-compliance. This vulnerability has been actively exploited in the wild by threat actors for data exfiltration and extortion, leading to its inclusion in the CISA KEV catalog.
Official Vendor Advisories & References
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
Frequently Asked SecOps Questions (CVE-2021-27101)
FAQQ1. How critical is CVE-2021-27101 and is it actively exploited in the wild?
CVE-2021-27101 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 6.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-27101?
Primary impacted vendors include accellion across fta. Scope summary: Accellion FTA versions 9_12_370 and earlier
Q3. What temporary mitigations or workarounds exist for CVE-2021-27101 before patching?
[Mitigation] Immediately upgrade Accellion FTA to version 9_12_380 or later and restrict external access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-27101
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (accellion)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.