CVE-2021-27101

Critical9.8Published on February 16, 2021

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Nov 3, 2021
US federal agencies must remediate it by Nov 17, 2021 (BOD 22-01)
First attack observed 55 days after disclosure
Used in ransomware campaigns

Apply updates per vendor instructions.

Source: CISA KEV · Sep 26, 2026 Aug 18, 2026 Jun 15, 2026 Mar 4, 2026 Feb 24, 2026 Jan 20, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendorsaccellion

Affected products

Vendors	Product	Versions
accellion	fta	<= 9_12_370

Ransomware

Clop Exploits Windchill: JSP Web Shell Steals Credentials and Engineering Data

Analysis of Clop ransomware's exploitation of CVE-2026-12569 in PTC Windchill, using a JSP web shell to steal engineering data and credentials from PLM servers.

Aug 19, 202615:106 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Actively exploited

Affected products

Related articles

Clop Exploits Windchill: JSP Web Shell Steals Credentials and Engineering Data