CVE-2021-27877
Published 2021-03-01 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2021-27877 is a high-severity (CVSS 8.2) vulnerability in Veritas Backup Exec Agent. CISA added it to the Known Exploited Vulnerabilities catalog on April 7, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 28, 2023. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Veritas has 3 vulnerabilities in the KEV catalog, 3 of them linked to ransomware.
All 3 known-exploited Veritas vulnerabilities →Description
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA Known-Exploited Vulnerability
Product: Veritas — Backup Exec Agent
Name: Veritas Backup Exec Agent Improper Authentication Vulnerability
Date added: 2023-04-07 · Due: 2023-04-28
Required action: Apply updates per vendor instructions.
References
- http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
- https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1
- http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
- https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27877