CVE-2021-27876: Veritas Backup Exec Agent authentication bypass enabling arbitrary file access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityNetwork-reachable authentication bypass with System-level file read, public exploit material, and CISA KEV listing with known ransomware use.

What it is

Veritas Backup Exec before 21.2 has a flaw in the SHA authentication scheme used between client and Agent. An attacker can bypass authentication and then issue data management protocol commands on the authenticated connection. Crafted parameters in one of those commands allow reading an arbitrary file with System privileges.

Impact

An attacker gains unauthorized access to the Backup Exec Agent and can read arbitrary files on the host with System privileges, exposing sensitive data and configuration. The flaw does not by itself grant write or code execution, though the referenced exploit material describes remote code execution.

Attack surface

Reached over the network via the client-to-Agent communication channel (AV:N). The vector lists PR:L, so some low-privileged access is required, and no user interaction is needed (UI:N).

Exploitation

Listed in CISA KEV with known ransomware campaign use and a due date of 2023-04-28, and EPSS 30-day probability is 0.13518 (96th percentile). References include an Exploit-tagged third-party advisory, indicating public exploit material exists.

What to do

• Upgrade Veritas Backup Exec to 21.2 or later per vendor advisory VTS21-001.
• Restrict network access to Backup Exec Agent ports to trusted management hosts only.
• Rotate credentials and review accounts that can reach the Agent service.
• Monitor for and block unauthorized client connections to the Agent.
• Apply the vendor-required action from the CISA KEV entry and track remediation to the due date.

Detection

• Alert on Backup Exec Agent authentication events that succeed from unexpected or non-management hosts.
• Monitor Agent logs for data management protocol commands with unusual file path parameters.
• Hunt for anomalous file read activity by the Backup Exec Agent service account, especially outside backup windows.
• Correlate network connections to Agent ports with known client inventory and flag outliers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.