Is CVE-2021-27104 (Accellion FTA OS Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-27104 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.

What active exploitation means for CVE-2021-27104

CISA’s KEV listing is the practical signal that matters most: this vulnerability is not just theoretically dangerous, it has been observed in the wild and was treated as an urgent remediation item. For defenders, the question is no longer whether exploitation is possible, but whether any Accellion FTA deployment still exposes the vulnerable admin surface.

That distinction changes triage. A remotely reachable web flaw that is already in active use should be handled as an exposure to investigate first, then as a patching problem, and only after that as a standard vulnerability management item. The fastest value comes from confirming whether the product is present anywhere, including legacy or forgotten instances.

When the issue is an OS command injection flaw, the security concern is not merely unauthorised input handling. Successful exploitation can convert a web request into system-level command execution, which is why active exploitation of this class of flaw often leads to immediate containment, not just scheduled maintenance.

Why the KEV listing changes prioritisation

The KEV catalogue is useful because it separates known exploited vulnerabilities from the far larger pool of unverified findings. That makes it a strong operational filter for emergency response, especially when the vulnerable product is an internet-facing file transfer platform that may have been deployed outside normal application inventory processes.

Zero-Day and Exploited Vulnerabilities Guide is the right internal reference when you need a triage model for active exploitation, because it covers KEV-style prioritisation, emergency mitigation, hotpatching and compromise assessment.

Vulnerability Management Guide adds the operational discipline behind that triage, including how to use evidence of exploitation to set remediation urgency, exceptions and verification.

For this CVE, the practical consequence is that normal scoring alone is not enough. If a vulnerability is in KEV and tied to ransomware activity, response should be driven by exposure and exploitability, not by whether the affected system has already triggered an alert.

What defenders should check before they assume they are safe

Start with asset confirmation, not patch status. Teams often miss the risk because the system is no longer in active use, has been inherited by another group, or is only reachable through a management network. If you cannot prove the product is absent, treat it as potentially exposed until you do.

CISA Known Exploited Vulnerabilities Catalog is the authoritative place to verify whether the vulnerability remains on the active exploitation list and to confirm the current remediation expectation.

NIST National Vulnerability Database is useful for pulling together the record and related metadata, but it should support, not replace, vendor and CISA guidance when you are deciding how to respond.

If the product is still present, review whether the admin endpoints described by the advisory are reachable from untrusted networks, whether any compensating controls exist, and whether logs cover the request patterns associated with exploitation. For a command injection issue, reachability and logging quality materially change the investigation path.

Risk and Threat Considerations

Active exploitation of a web-facing command injection flaw creates two linked risks: immediate remote compromise and downstream credential or data exposure. Once attackers can execute commands on the appliance, they may pivot to file contents, configuration data, connected systems, or cached secrets.

Failure mechanism: A crafted request to an exposed administrative endpoint can trigger command execution on the target, bypassing the intended trust boundary around the file transfer service.

Impact: The consequence can range from initial foothold to broader compromise, including theft of sensitive files, staging of ransomware, or use of the appliance as a launch point into adjacent systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Active exploitation requires risk-based prioritisation of remediation and investigation.
Recommendation — Prioritise exposed KEV items for immediate response and track them in your risk register.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Known exploited flaws require rapid remediation and exception handling.
Recommendation — Accelerate remediation for actively exploited vulnerabilities and document any delay as an exception.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The subject is exploited vulnerability triage, verification and urgent remediation.
Recommendation — Continuously identify and remediate KEV-listed vulnerabilities across the asset estate.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	The vulnerability is exploited through a public-facing web endpoint.
Recommendation — Hunt for public-facing exploitation patterns and contain affected hosts quickly.
OWASP ASVS	V4 — API and Web Service	The flaw is a web request handling weakness in an exposed administrative interface.
Recommendation — Verify server-side request handling and block unsafe request paths on exposed services.

Practitioner Guidance

What to prioritise: First confirm whether any Accellion FTA instance still exists, then determine whether it was internet reachable during the exploitation window. If the answer is yes or unknown, treat the host as a compromise investigation candidate before you spend time on routine patch workflow.

What to verify: Check web, appliance and authentication logs for admin-endpoint requests, abnormal POST activity, unexpected child processes and signs that the system executed commands outside normal file-transfer behaviour. Where logs are incomplete, compensate by validating file integrity, scheduled tasks and outbound connections from the appliance.

Decision rule: If you cannot confidently rule out exploitation, assume credential and data exposure may have occurred and rotate any secrets, service credentials or connected account material that the appliance could access. The need to rotate depends on reachable blast radius, not on proof of theft.

Practitioner takeaway: KEV status means the response bar is higher than ordinary vulnerability remediation, so exposure confirmation and compromise assessment should happen before any assumption of safety.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org