CVE-2021-27876

Think of Backup Exec as the “vault manager” that talks to other machines to store and manage backups. This flaw lets an attacker pretend to be a legitimate client and then ask the system to open files it should never expose—effectively giving them a master key to the server’s files.

This matters if you run Veritas Backup Exec and your Backup Exec/Agent services can be reached by someone from a network connection. It is specifically a risk when an attacker can communicate with the Veritas Backup Exec service over the network.

If those services aren’t reachable from untrusted networks, the risk is much lower; if they are reachable, assume it’s exploitable by a remote attacker.

This is RED because confirmed real-world exploitation has been used in ransomware campaigns, and the vulnerability is listed in the CISA KEV. Attackers don’t need users to click anything; if they can reach the Backup Exec service, they can bypass authentication and read arbitrary files with system-level privileges.

1. Confirm exposure in your environment

   • Determine your installed Veritas Backup Exec version and check whether it is before 21.2.
   • Verify where the Backup Exec/Agent communication is reachable from (e.g., internal networks vs. the wider internet, VPN segments, remote access gateways).
   • Review firewall rules and network segmentation to see whether the Backup Exec service is reachable from untrusted networks.

2. Validate the likely affected configuration

   • This issue requires the attacker to be able to communicate with the Veritas Backup Exec service over the network.
   • If your Backup Exec setup exposes its management/agent communication ports to anything beyond trusted admin networks, treat it as exposed.

3. Upgrade to the fixed version

   • Update Veritas Backup Exec to version 21.2 or later (the documented fixed point in the findings).
   • Follow Veritas vendor instructions for the specific VTS advisory referenced for CVE-2021-27876.
   • If your upgrade path has dependencies (e.g., maintenance windows, database/service checks), coordinate them now so you can complete the upgrade quickly.

4. If you cannot patch immediately (temporary risk reduction)

   • Restrict network access so the Backup Exec service is not reachable from untrusted networks.
   • Lock down any paths that allow client/agent communication from non-admin sources.

5. After patching

   • Confirm the Backup Exec service is running normally and that required legitimate clients/agents still connect.
   • Monitor for suspicious connection attempts to Backup Exec/Agent services from unexpected IPs (especially around the time of any failed authentication attempts), and review logs as part of your incident-readiness process.

6. KEV timeline

   • CISA remediation due date listed in the findings: 2023-04-28.

Severity is high (CVE-2021-27876) with a mechanism that enables bypass of authentication in Veritas Backup Exec’s SHA Authentication scheme. Attackers over the network can complete authentication and then send crafted data management protocol commands to read arbitrary files on the host using SYSTEM-level privileges.

Exploitation status: Listed in CISA KEV (added 2023-04-07) and used in ransomware campaigns, so this is treated as confirmed actively exploited. A public exploit is available, increasing practicality.

EPSS is predicted and rising (not relied upon for the urgency because KEV confirmation takes precedence). The weakness is tracked under a non-specific CWE category in the findings.