← Vulnerability feed

Vulnerability record · CVE-2017-8857 · published 9 May 2017

CVE-2017-8857: Veritas netbackup incorrect permission assignment vulnerability

VVeritas · Netbackup

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process.

9.8 CVSS 3.0 Critical EPSS 5.7% · top 7.3% CWE-732 · Incorrect permission assignment
9.8CVSS 3.0 base score, v2 10.0
5.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/98384 Third Party AdvisoryVDB Entry
https://www.veritas.com/content/support/en_US/security/VTS17-004.html#Issue2 Vendor Advisory
http://www.securityfocus.com/bid/98384 Third Party AdvisoryVDB Entry
https://www.veritas.com/content/support/en_US/security/VTS17-004.html#Issue2 Vendor Advisory

Track CVE-2017-8857 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-22965Spring Framework data binding remote code execution (Spring4Shell)Spring MVC and Spring WebFlux applications on JDK 9+ can be exploited through data binding to achieve remote code execution. The known exploit path r…KEVEPSS 100%analysed9.8CVE-2024-28222Veritas netbackup path traversal vulnerabilityIn Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenti…EPSS 0.99%9.8CVE-2022-42307Veritas netbackup xml external entity (xxe) vulnerabilityAn issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML Exte…EPSS 0.56%9.8CVE-2022-42303Veritas netbackup sql injection vulnerabilityAn issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order …EPSS 0.54%9.8CVE-2022-42304Veritas netbackup sql injection vulnerabilityAn issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection…EPSS 0.54%9.8CVE-2022-42302Veritas netbackup sql injection vulnerabilityAn issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection…EPSS 0.56%9.8CVE-2022-36986Veritas flex appliance vulnerabilityAn issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and rel…EPSS 0.95%9.8CVE-2022-36952Veritas netbackup hard-coded credentials vulnerabilityIn Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through …EPSS 0.51%

Source: NIST National Vulnerability Database (record CVE-2017-8857), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.