CVE-2021-27877

Veritas Backup Exec Agent — the remote agent component of Veritas Backup Exec — still accepts a legacy 'SHA' authentication scheme that current versions no longer use but had never disabled, an improper authentication flaw tracked as CVE-2021-27877. Because the obsolete scheme remains enabled, a remote, unauthenticated attacker can authenticate to the Agent's network service and issue privileged commands, effectively achieving remote code execution on the host (CVSS 3.1: 9.8, Critical). Any Backup Exec deployment running a version before 21.2 is affected wherever the Agent service is reachable — either exposed to the internet or reachable inside the network after an initial compromise. A public proof-of-concept remote code execution exploit is available, and the flaw carries a very high near-term exploitation likelihood (EPSS ~65%). The bug is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-04-07 with known ransomware use, and the ALPHV/BlackCat ransomware affiliate has been reported targeting Veritas Backup Exec flaws.

What to do: Upgrade Veritas Backup Exec to 21.2 or later per vendor instructions, as required by CISA's Known Exploited Vulnerabilities catalog. As an interim mitigation, restrict the Backup Exec Agent service (TCP/10000) to trusted backup servers and block it from untrusted networks, including the internet. Given confirmed ransomware use by ALPHV/BlackCat, prioritize patching internet-exposed and high-value backup servers.