← Vulnerability feed

Vulnerability record · CVE-2024-33671 · published 26 April 2024

CVE-2024-33671: Veritas backup exec vulnerability

VVeritas · Backup Exec

An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.

7.1 CVSS 3.1 High EPSS 0.17% · top 94.6% CWE-73 · CWE-73
7.1CVSS 3.1 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded Streaming Agent can be leveraged to perform arbitrary file deletion on protected files.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.veritas.com/support/en_US/security/VTS24-002#H1 Vendor Advisory
https://www.veritas.com/support/en_US/security/VTS24-002#H1 Vendor Advisory

Track CVE-2024-33671 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-27877Veritas Backup Exec Agent improper authentication via legacy SHA schemeVeritas Backup Exec before 21.2 still supported a legacy SHA authentication scheme that should have been disabled. Because that scheme is weak, an un…KEVEPSS 65%analysed8.8CVE-2021-27878Veritas Backup Exec Agent SHA authentication bypass leading to command executionVeritas Backup Exec before 21.2 contains a flaw in the SHA authentication scheme used between client and Agent. An attacker can bypass authentication…KEVEPSS 24%analysed8.1CVE-2021-27876Veritas Backup Exec Agent authentication bypass enabling arbitrary file accessVeritas Backup Exec before 21.2 has a flaw in the SHA authentication scheme used between client and Agent. An attacker can bypass authentication and …KEVEPSS 14%analysed9.8CVE-2017-8895Veritas Backup Exec agents use-after-free allows remote code executionVeritas Backup Exec 2014, 15 and 16 contain a use-after-free flaw in multiple agents. An unauthenticated attacker can crash the agent or potentially …EPSS 71%analysed8.8CVE-2020-36167Veritas backup exec unrestricted file upload vulnerabilityAn issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517. On start-up, it …EPSS 0.46%7.8CVE-2024-33673Veritas backup exec improper access control vulnerabilityAn issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacking in the Windows DLL Search …EPSS 0.16%7.5CVE-2005-0772Veritas backup exec null pointer dereference vulnerabilityVERITAS Backup Exec 9.0 through 10.0 for Windows Servers, and 9.0.4019 through 9.1.307 for Netware, allows remote attackers to cause a denial of serv…EPSS 36%8.8CVE-2025-33053Microsoft Windows WebDAV Internet Shortcut File Path Control RCEWindows Internet Shortcut (.url) files allow external control of a file name or path, which an unauthorized attacker can abuse to execute code over a…KEVEPSS 87%analysed

Source: NIST National Vulnerability Database (record CVE-2024-33671), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.