Veritas Backup Exec Agent Authentication Bypass and Remote Code Execution Vulnerability (CVE-2021-27876) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTVeritas Backup Exec Remote Agent installed on Windows and Linux systems prior to version 21.2
Attackers can bypass authentication via flaws in the SHA Authentication scheme, gaining unauthorized access to execute data management commands with System privileges, leading to arbitrary file access and remote code execution
Immediately upgrade Veritas Backup Exec to version 21.2 or later, and restrict network access to the NDMP port (TCP 10000)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
According to Veritas security advisory VTS21-001, administrators must upgrade Backup Exec to version 21.2 or later. Use the following PowerShell commands to stop the agent, apply the patch, and restart the service on Windows hosts:
# Check and stop the Backup Exec Agent service
Get-Service -Name 'BackupExecAgentAccelerator' | Stop-Service -Force
# Execute the Veritas official patch installer silently
Start-Process -FilePath 'C:\Patches\Backup_Exec_21.2_Patch.exe' -ArgumentList '/silent /qn' -Wait
# Restart the service and verify status
Start-Service -Name 'BackupExecAgentAccelerator'
Get-Service -Name 'BackupExecAgentAccelerator'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the NDMP port (TCP 10000) using host-based firewalls to allow only authorized backup servers.
# Restrict NDMP port (10000) to a trusted backup server IP (e.g., 192.168.1.50) on Linux
iptables -A INPUT -p tcp -s 192.168.1.50 --dport 10000 -j ACCEPT
iptables -A INPUT -p tcp --dport 10000 -j DROP
# Save the iptables rules permanently
apt-get install iptables-persistent -y
netfilter-persistent save3. Log Audit & IoC Verification Commands
Verify the installed version of the Veritas Remote Agent and check if port 10000 is exposed to untrusted networks.
# Check the Veritas Remote Agent binary version on Linux
if [ -f '/opt/VRTSralus/bin/beremote' ]; then
echo '[!] Veritas Remote Agent detected.'
/opt/VRTSralus/bin/beremote -v
fi
# Audit active listening ports for NDMP (TCP 10000)
netstat -antp | grep 10000Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists due to an implementation flaw in the SHA Authentication scheme of the Veritas Backup Exec Agent. Normally, communication between a client and the Remote Agent requires robust authentication over a secure TLS channel. However, due to improper validation during the SHA authentication handshake, an attacker can bypass the authentication process entirely without providing valid credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates a connection to the NDMP (Network Data Management Protocol) service listening on TCP port 10000. By sending a specially crafted SHA authentication packet, the attacker tricks the agent into establishing an authenticated session. Once authenticated, the attacker can issue arbitrary NDMP data management commands. By manipulating input parameters within these commands, the attacker can perform directory traversal to access, read, or write arbitrary files with SYSTEM/root privileges, ultimately leading to full remote code execution.
3. Infrastructure & Business Impact
This vulnerability is highly critical and is actively exploited in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. Because backup agents run with elevated system privileges and have direct access to critical data repositories, compromise of this service allows attackers to pivot laterally, deploy ransomware, exfiltrate sensitive business data, and compromise the entire active directory domain.
Official Vendor Advisories & References
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
Frequently Asked SecOps Questions (CVE-2021-27876)
FAQQ1. How critical is CVE-2021-27876 and is it actively exploited in the wild?
CVE-2021-27876 is rated CVSS 8.1 (HIGH) with a 30-day EPSS exploitation probability of 13.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-27876?
Primary impacted vendors include veritas across backup_exec, backup_exec_agent. Scope summary: Veritas Backup Exec versions prior to 21.2 (including Remote Agents on all supported platforms)
Q3. What temporary mitigations or workarounds exist for CVE-2021-27876 before patching?
[Mitigation] Immediately upgrade Veritas Backup Exec to version 21.2 or later, and restrict network access to the NDMP port (TCP 10000) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-27876
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (veritas)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.