Yes. CISA added CVE-2021-27101 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.
How to confirm active exploitation of CVE-2021-27101
For this CVE, the practical question is not whether the flaw exists, but whether your internet-facing Accellion FTA instance was exposed during the exploitation window. CISA’s KEV listing is the strongest signal to treat it as an active-threat issue, and you should use the vendor advisory plus the KEV catalogue to confirm scope, urgency and remediation expectations.
Because the vulnerability is a SQL injection issue reached through a crafted request to document_root.html, the first check is whether the FTA service was reachable from untrusted networks and whether any logging, proxy data or WAF records show requests that match that access pattern. If the platform was externally exposed, assume you need both vulnerability handling and compromise assessment, not just patching.
The most useful way to think about this class of issue is that exploitation often leaves only partial evidence. A successful injection attempt may not create a neat application error, so confirmation usually depends on correlating web logs, upstream reverse proxy logs, database activity and any file-integrity or process-level anomalies on the file transfer host.
What the vulnerable path means operationally
This is a web application injection weakness in a file transfer platform, so the risk extends beyond the application itself. If attackers can influence SQL execution through a crafted host header, they may be able to enumerate data, alter application behaviour or pivot toward broader access depending on how the backend was configured and what the application account could reach.
In practice, the main operational question is the blast radius of the FTA deployment. If the appliance had access to sensitive documents, database credentials, shared storage or adjacent internal services, the exploitation impact can be much larger than a simple application defect would suggest. That is why the KEV classification matters, it is a signal to treat the flaw as an exposure with real-world misuse potential, not a theoretical SQLi finding.
For validation and context, the CISA Known Exploited Vulnerabilities Catalog is the authoritative source for the active-exploitation designation, and the NIST National Vulnerability Database remains the canonical place to confirm the CVE record and reference details. If you need a baseline for how SQL injection turns into application compromise, the OWASP Top 10 is the right high-level reference, while the CVE Program is the canonical identifier source.
What to do while you verify exposure and compromise
Priority one is containment. If the FTA system is still reachable, restrict exposure, preserve logs and capture a forensic image or at least a consistent snapshot before making changes that could destroy evidence. If patching or decommissioning must wait, segment the system and limit outbound connectivity so an attacker cannot easily reuse any foothold gained through the application.
Next, validate whether the appliance handled sensitive traffic or stored any reusable secrets. If the FTA instance authenticated to databases, file shares or internal APIs, rotate the credentials or keys that could have been exposed through the application or through post-exploitation access, and review any sessions or tokens issued through the platform.
For deeper scoping, review authentication logs, application traces and database activity for unusual queries, new accounts, unexpected exports, or changes to application configuration. If you find signs of access outside the normal file transfer workflow, treat it as a possible compromise of the whole trust boundary, not only the web front end.
The FIRST EPSS service is useful when you need to combine active exploitation context with broader prioritisation, but for this question the KEV listing should drive immediate operational urgency. The Zero-Day and Exploited Vulnerabilities Guide is a useful internal playbook for triage, emergency mitigation and post-patch hunting when a vulnerability is already known to be exploited.
Risk and Threat Considerations
Actively exploited SQL injection on a file transfer platform is high-risk because the attack surface is internet-facing, the data handled is often sensitive, and the exploitation path can be simple enough to automate. Once a foothold exists, attackers may use the system to access files, harvest credentials or stage follow-on activity inside the network.
Failure mechanism: The attacker abuses crafted request handling to influence backend SQL execution, then uses the application’s trusted position to read, modify or extract data and potentially move into adjacent systems that the appliance can reach.
Impact: Expect possible data exposure, integrity loss, secondary credential compromise and a wider incident response scope if the platform had access to internal repositories, shared storage or downstream services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Exposed file transfer systems often rely on privileged service access. |
| Recommendation — Review and revoke unnecessary accounts and service access tied to the appliance. | ||
| OWASP ASVS | V8 — Authorization | SQL injection often turns into unauthorized data access or function abuse. |
| V16 — Security Logging and Error Handling | Confirming exploitation depends on usable request and backend evidence. | |
| Recommendation — Validate authorization boundaries on data-accessing functions and backend queries. Retain security logs and error telemetry needed to investigate injection attempts. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Investigation of active exploitation depends on correlating web and database events. |
| SI-10 — Information Input Validation | The flaw is a request-handling injection weakness at the application boundary. | |
| Recommendation — Correlate application, proxy and database logs to identify suspicious activity. Enforce strict input validation and trust-boundary checks on request fields. | ||
Practitioner Guidance
What to verify: Confirm whether the Accellion FTA instance was internet-exposed during the exploitation period, whether request logs show suspicious host headers or anomalous access to document_root.html, and whether any backend activity deviated from normal file transfer behaviour.
Escalation / exception: If the system handled regulated data, was directly reachable from the internet, or had privileged backend connectivity, treat the issue as a potential breach investigation, not a routine patch task. If evidence is incomplete, assume compromise until disproven.
Practitioner takeaway: For a KEV-listed vulnerability like this, the decision point is not “patch or not”, it is whether you can still trust the appliance’s state after exposure. If you cannot establish that trust quickly, prioritise containment, forensics and credential rotation alongside remediation.