CVE-2021-27876 kev+ ransomware in the critical feed json
An issue was discovered in Veritas Backup Exec before 21.2.
published 2021-03-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-14614
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Exploited
- added 2023-04-07, used in ransomware
- epss
- 13.5%
- EPSS 13.5% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Metasploit
Summary
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
Patch / fix
cisa required action Apply updates per vendor instructions.
- veritas backup_exec 21.2
Timeline
- First public exploit (Metasploit exploit/multi/veritas/beagent_sha_auth_rce)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 3 y ago
- Patch by
- 2023-04-28 (3 y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Veritas, Backup Exec Agent
- CISA name
- Veritas Backup Exec Agent File Access Vulnerability
Ransomware
Groups reported to have exploited it in intrusions.
- ALPHV ransomware gang
reported by cloud.google.com
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
13.52% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/veritas/beagent_sha_auth_rce Veritas Backup Exec Agent Remote Code Execution metasploit exploit, excellent rank, 2021-03-01
- packetstormsecurity.com http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:S/C:C/I:P/A:N |
References
-
packetstormsecurity.com
/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html
exploit, third-party-advisory, vdb-entry
-
veritas.com
/content/support/en_US/security/VTS21-001#issue2
vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27876
government-resource, us-government-resource
Sources
- CVE List CVE-2021-27876
- NVD CVE-2021-27876
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.