CVE-2021-27878: Veritas Backup Exec Agent SHA authentication bypass leading to command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityRemote authentication bypass leading to system-level command execution, listed in CISA KEV with known ransomware use and a high EPSS score.

What it is

Veritas Backup Exec before 21.2 contains a flaw in the SHA authentication scheme used between client and Agent. An attacker can bypass authentication and then issue data management protocol commands on the authenticated connection. Because one of those commands allows arbitrary command execution with system privileges, the flaw is a full compromise path on affected installations.

Impact

An attacker gains authenticated access to the Backup Exec Agent and can execute arbitrary commands with system privileges, effectively taking over the host. This can lead to data theft, ransomware deployment, or further lateral movement.

Attack surface

Reachable over the network via the client-to-Agent communication channel (CVSS AV:N). The vector indicates low privileges (PR:L) and no user interaction (UI:N), so the attacker needs some initial access or credentials but not administrative rights.

Exploitation

Listed in CISA KEV with known ransomware campaign use, and a public exploit reference exists on Packet Storm. EPSS is 0.23952 (97.7th percentile), indicating high likelihood of exploitation activity.

What to do

• Upgrade Veritas Backup Exec to version 21.2 or later per vendor advisory VTS21-001.
• Restrict network access to Backup Exec Agent ports to trusted management hosts only.
• Rotate credentials and review accounts that can reach the Agent service.
• Monitor for unexpected command execution or data management protocol activity from Agent connections.
• Apply CISA KEV required actions and track remediation by the 2023-04-28 due date if still outstanding.

Detection

• Alert on Backup Exec Agent authentication events that succeed without expected TLS client identity or from unusual source hosts.
• Hunt for child processes spawned by the Backup Exec Agent service, especially command interpreters or scripting engines.
• Monitor network traffic to Agent ports for anomalous data management protocol commands.
• Correlate Backup Exec Agent activity with ransomware precursor behaviors such as credential dumping or lateral movement.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.