PatchTheCVECVE-2021-27856: FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named
CVE-2021-27856 is a critical-severity flaw (CVSS 9.8) affecting ipvpn firmware, mpvpn firmware, warp firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this vulnerability is FPSA002.
Why this priority
- Critical severity
- EPSS top 7%: very likely to be exploited
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 5.5% (top 7%) |
| CISA exploited list | No |
| Published | 2021-12-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: FatPipe WARP/IPVPN/MPVPN - Backdoor Account
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-27856?
ipvpn firmware: mitigate or apply the listed mitigation; mpvpn firmware: mitigate or apply the listed mitigation; warp firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-27856 being exploited?
CVE-2021-27856 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-27856 affect?
CVE-2021-27856 affects ipvpn firmware, mpvpn firmware, warp firmware. Severity is critical (CVSS 9.8). FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPi
How urgent is CVE-2021-27856?
Priority 62/100. Critical severity; EPSS top 7%: very likely to be exploited; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2021-27860 CRITICAL 9.8 EXPLOITED MITIGATE MITIGATE FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
- CVE-2021-27859 HIGH 8.8 MITIGATE MITIGATE A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN softwa
- CVE-2021-27858 MEDIUM 5.3 MITIGATE MITIGATE A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN softwa
- CVE-2021-27857 HIGH 7.5 MITIGATE MITIGATE A missing authorization vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN softwa
- CVE-2021-27855 HIGH 8.8 MITIGATE MITIGATE FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenti