CVE-2021-27878

CVE-2021-27878 is an improper authentication flaw (CWE-287) in the Veritas Backup Exec (BE) Agent that allows an attacker to use a data management protocol command to execute a command on the machine running the Agent. It is triggered by sending crafted data management protocol commands to the Agent's service, bypassing its authentication checks. Successful exploitation gives the attacker command execution on the BE Agent host — typically a backup server or any protected server running the Agent — providing a foothold for lateral movement, and it has been used in ransomware attacks. Any organization running Veritas Backup Exec with Agents deployed on servers being backed up is affected; specific affected and fixed version ranges are not enumerated in the source data. The flaw is being actively exploited: CISA added it to the KEV catalog on 2023-04-07 with known ransomware use, and EPSS assigns a 24% probability of exploitation within 30 days (98th percentile), though no public PoC is known.

What to do: Apply the patched Backup Exec/Agent updates per Veritas' vendor instructions (CISA's required action), prioritizing backup servers and any Agent hosts with broad network reach given known ransomware use. Restrict the Agent's data management protocol listening port (default TCP 10000) to trusted backup-network hosts and review Agent logs for unexpected protocol commands or post-exploitation activity.