CVE-2021-27876

CVE-2021-27876 is a flaw in the SHA authentication scheme used between a client and the Veritas Backup Exec Agent: although this authentication normally occurs over TLS, the vulnerable implementation lets an attacker gain unauthorized access and complete the authentication process. Once connected, the attacker can issue data management protocol commands, and crafted input parameters in one of these commands allow access to an arbitrary file on the target host with System privileges; a public proof-of-concept (published as a remote code execution exploit on PacketStorm) is available. Any organization running Veritas Backup Exec before 21.2 with the Agent reachable over the network is affected; the vector is network-based with no user interaction, though the flawed authentication handshake must be completed. The bug was added to CISA's Known Exploited Vulnerabilities catalog on 2023-04-07 with known ransomware use, and the ALPHV/BlackCat ransomware affiliate has been reported targeting Veritas Backup Exec flaws; EPSS estimates a 13.5% probability of exploitation within 30 days (96th percentile).

What to do: Upgrade to Veritas Backup Exec 21.2 or later, applying updates per the vendor's instructions as required by CISA. Until patched, restrict Agent traffic (typically TCP port 10000) to trusted backup servers via firewall rules and avoid exposing the Agent to the internet. Prioritize remediation given KEV listing and known ransomware use, and check the environment for indicators of ALPHV/BlackCat activity targeting Backup Exec.