CVE-2021-27877: Veritas Backup Exec Agent improper authentication via legacy SHA scheme

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote code execution, KEV-listed with known ransomware use, and public exploit code make this an urgent patch.

What it is

Veritas Backup Exec before 21.2 still supported a legacy SHA authentication scheme that should have been disabled. Because that scheme is weak, an unauthenticated remote attacker can bypass authentication to a Backup Exec Agent and run privileged commands. The flaw is remotely reachable, trivially exploitable, and has been used in ransomware campaigns.

Impact

An attacker gains unauthorized access to a Backup Exec Agent and can execute privileged commands on the host, effectively taking over the backup server and any data or systems it manages.

Attack surface

Reachable over the network against the Backup Exec Agent service; the CVSS vector shows no privileges and no user interaction required. No authentication is needed because the flaw is in the authentication scheme itself.

Exploitation

Listed in CISA KEV with known ransomware campaign use, and EPSS is 0.6491 (99.2nd percentile). Public exploit code is referenced on Packet Storm, so exploitation is active and reliable.

What to do

• Upgrade Veritas Backup Exec to 21.2 or later, which removes the legacy SHA authentication scheme.
• If immediate upgrade is not possible, restrict network access to Backup Exec Agent ports to trusted management hosts only.
• Disable or block the legacy SHA authentication scheme per Veritas advisory VTS21-001.
• Segment backup servers from general user networks and monitor for lateral movement from them.
• Treat any Backup Exec Agent host as potentially compromised and rotate credentials after patching.

Detection

• Monitor Backup Exec Agent logs for authentication attempts using the legacy SHA scheme or unexpected successful logins.
• Alert on unusual child processes spawned by Backup Exec Agent service processes.
• Hunt for network connections to Backup Exec Agent ports from hosts outside the backup management subnet.
• Correlate Backup Exec host activity with ransomware indicators such as mass file encryption or shadow copy deletion.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.