Is CVE-2021-27931 actively exploited?

Yes. CVE-2021-27931 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-27931 be exploited remotely?

The attack vector of CVE-2021-27931 has not been classified yet.

What is the CVSS score of CVE-2021-27931?

CVE-2021-27931 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-27931

UNKNOWNCISA KEVIN THE WILD

CVE-2021-27931

Published: April 11, 2026

EPSS:89.42%probability of exploitation in 30 daysPercentile:99.5th

Official Description

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

NVD Source

Risk Analysis

This vulnerability in LumisXP allows an unauthenticated attacker to perform XML External Entity (XXE) attacks. This can lead to reading sensitive server files or causing a denial of service. The confirmed exploitation in the wild makes this a critical concern.

Active exploitation of this vulnerability has been observed in the wild, and it is listed in CISA's KEV catalog. The flaw is remotely exploitable without authentication.

Recommended Action

Upgrade LumisXP to version 10.0.0 or later to address this vulnerability. Ensure all web-facing applications are regularly updated and configured securely.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2021-27931 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-27931 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.