CVE-2021-27104 is an OS command injection vulnerability in Accellion FTA. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.
What This Vulnerability Means
OS command injection is dangerous because the application passes attacker-controlled input into operating system commands, which can turn a web request into direct server-side execution. In a file transfer appliance, that can expose administration functions, data flows, and the host itself to takeover.
With an actively exploited CVE like this one, the concern is not just a theoretical flaw in input handling. It is a proven attack path that can be reachable through exposed management surfaces, weakly protected endpoints, or overlooked internet-facing instances.
Why Accellion FTA Was a High-Value Target
Accellion FTA was used for file transfer and administrative operations, so a command injection weakness in that product could give an attacker a direct route from a crafted HTTP request to privileged execution. That makes the issue especially serious in environments that used the appliance to broker sensitive documents or external collaboration.
The practical danger is that command execution in this kind of system can be chained into data theft, persistence, and broader access to connected services. Even when the initial flaw is specific to one product, the blast radius often extends to the surrounding business process, not just the appliance itself.
How Organisations Check Exposure and Recover
Exposure checks start with an asset inventory, because teams first need to know whether Accellion FTA was ever deployed, where it is reachable, and whether any instances were internet-facing during the relevant period. Vendor advisories and the NIST National Vulnerability Database help correlate the CVE with the product record, while the CVE Program is the authoritative identifier for the vulnerability itself.
Where patching is delayed, organisations should treat the appliance as potentially exposed and reduce attack surface by restricting administrative access, isolating the service, and reviewing any compensating controls around inbound requests. A broader vulnerability process, such as NHIMG’s Vulnerability Management Guide, is useful here because exploited CVEs require prioritisation based on real exposure, not just severity labels.
Detection, Remediation, and Identity Impact
Because this weakness was used in real attacks, defenders should review logs and telemetry for unusual POST activity to administrative endpoints, unexpected command execution patterns, and signs that the appliance was used as an initial foothold. After remediation, the review should not stop at the vulnerable host, because compromise of a transfer platform can also expose credentials, sessions, keys, or service accounts tied to the surrounding workflow.
When an attacker can execute commands on a system that brokers sensitive transfers, the downstream identity impact is often the hidden part of the incident. Rotating exposed secrets and validating connected accounts is often as important as removing the vulnerable software itself, especially if the appliance stored integration credentials or administrative access material.
Risk and Threat Considerations
This vulnerability is attractive to attackers because command injection can convert a single reachable endpoint into broad host-level control, and file transfer products often sit close to sensitive content and privileged workflows. If the appliance is externally reachable, the attack path can be short, repeatable, and difficult to contain once execution is obtained.
Failure mechanism: The application accepts crafted input in a way that reaches an operating system command context, allowing attacker-supplied instructions to execute with the appliance’s privileges.
Impact: Attackers may steal data, manipulate transfers, establish persistence, or pivot into adjacent systems that trust the appliance or its associated accounts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V4 — API and Web Service | OS command injection is a web service input-handling failure. |
| V15 — Secure Coding and Architecture | This vulnerability reflects unsafe command construction and trust boundaries. | |
| Recommendation — Validate and constrain request inputs that reach server-side command execution. Remove command construction from untrusted input paths and redesign unsafe execution flows. | ||
| CIS Controls v8 | CIS-07 — Continuous Vulnerability Management | The term is an exploited CVE requiring exposure review and fast remediation. |
| CIS-08 — Audit Log Management | Detection depends on reviewing appliance and endpoint logs for abuse signs. | |
| Recommendation — Prioritise, remediate, and verify exploited vulnerabilities on exposed assets. Centralise and review logs for malicious request and command-execution indicators. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Input Validation | Command injection arises when untrusted input is not safely validated or constrained. |
| Recommendation — Validate inputs before they can reach command interpreters or system utilities. | ||
Practitioner Guidance
Why practitioners should care: For actively exploited CVEs in edge or file-transfer products, the operational question is usually not whether the bug is serious, but whether the exposed instance can still be reached and abused before remediation is complete. Prioritise any internet-facing deployment, any instance that handled sensitive data, and any system whose logs suggest administrative request abuse.
Practitioner takeaway: Treat the appliance as a potential compromise candidate until exposure is verified, remediation is complete, and post-patch validation shows no evidence of abuse.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org