CVE-2021-27877
KEVRansomware UseVeritas Backup Exec Agent Improper Authentication Vulnerability
Description
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NPublishedMar 1, 2021
Last modifiedJun 17, 2026
Added to KEVApr 7, 2023
Remediation dueApr 28, 2023
References
- packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.htmlExploitThird Party Advisory
- veritas.com/content/support/en_US/security/VTS21-001Vendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27877US Government Resource
0 recent articles mention this CVE
87
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1278 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 8.2 HIGH
- EPSS (30-day exploit probability)
- 64.9% · top 1% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.