CVE-2021-27860: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-01-10. EPSS: 39.8% chance of exploitation in the next 30 days.

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.

Affected products

• Fatpipeinc IPVPN Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only
• Fatpipeinc MPVPN Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only
• Fatpipeinc WARP Firmware: version 5.2.0 only; version 6.1.2 only; version 7.1.2 only; version 9.1.2 only; version 10.1.2 only; version 10.2.2 only

Published 2021-12-08. Last modified 2026-06-17.