Veritas Backup Exec Agent Authentication Bypass and Remote Code Execution Vulnerability (CVE-2021-27877) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTVeritas Backup Exec Agent versions prior to 21.2 (Windows/Linux)
Remote attackers can bypass authentication to gain unauthorized access to the Agent and execute privileged commands with SYSTEM/root privileges
Immediately upgrade Veritas Backup Exec to version 21.2 or later, or restrict network access to the Agent port (default TCP 10000)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading the Veritas Backup Exec server and its remote agents to version 21.2 or later.
You can verify the installed version and apply updates on Windows hosts using PowerShell:
# Check the installed version of Veritas Backup Exec Agent
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*Backup Exec*' } | Select-Object Name, Version
# Execute the official Veritas patch installer silently
Start-Process -FilePath 'C:\Path\To\Backup_Exec_21.2_Patch.exe' -ArgumentList '/silent /qn' -Wait2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the NDMP port (TCP 10000) using host-based firewalls to allow connections only from authorized backup servers.
Configure Windows Firewall via PowerShell to restrict access:
# Disable existing permissive rules for NDMP
Disable-NetFirewallRule -DisplayName 'Veritas Backup Exec Agent' -ErrorAction SilentlyContinue
# Block all unauthorized traffic to TCP port 10000
New-NetSecurityRule -DisplayName 'Block Unauthorized NDMP Access' `
-Direction Inbound `
-Action Block `
-Protocol TCP `
-LocalPort 10000
# Allow only the trusted Backup Server IP (e.g., 192.168.10.50)
New-NetSecurityRule -DisplayName 'Allow Trusted Backup Server' `
-Direction Inbound `
-Action Allow `
-Protocol TCP `
-LocalPort 10000 `
-RemoteAddress '192.168.10.50'3. Log Audit & IoC Verification Commands
Use the following commands to inspect active connections and audit logs for potential exploitation attempts.
# Check if the NDMP port (10000) is active and inspect established connections on Linux
netstat -antp | grep :10000
# Search Backup Exec Agent logs for suspicious authentication or connection patterns
grep -i -E 'auth|sha|failed' /var/log/BackupExec/*.log 2>/dev/nullBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the way the Veritas Backup Exec Agent handles legacy authentication mechanisms. Veritas Backup Exec historically supported multiple authentication schemes, including SHA authentication, to maintain backward compatibility. Although this SHA authentication scheme is no longer utilized in modern versions of the product, the underlying code was not disabled or removed from the agent. Consequently, an attacker can force the agent to negotiate using this legacy, insecure authentication scheme to bypass standard authentication controls.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the exploit by establishing a connection to the Network Data Management Protocol (NDMP) service listening on the default port TCP 10000 of the target agent. During the initial handshake, the attacker explicitly requests to authenticate using the legacy SHA authentication scheme. Because the agent fails to reject this deprecated scheme, the attacker can exploit flaws in the authentication logic to successfully establish an authenticated session without providing valid credentials. Once authenticated, the attacker leverages NDMP commands to execute arbitrary system commands or manipulate files on the host.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability represents an active and severe threat. Backup agents typically run with administrative privileges (SYSTEM on Windows, root on Linux) to perform system-wide backup operations. Successful exploitation allows complete compromise of the host, enabling attackers to deploy ransomware, destroy backup archives, or pivot deeper into the internal network, causing catastrophic business disruption.
Official Vendor Advisories & References
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
Frequently Asked SecOps Questions (CVE-2021-27877)
FAQQ1. How critical is CVE-2021-27877 and is it actively exploited in the wild?
CVE-2021-27877 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 64.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-27877?
Primary impacted vendors include veritas across backup_exec, backup_exec_agent. Scope summary: Veritas Backup Exec versions prior to 21.2 (including Backup Exec Agents on all supported platforms)
Q3. What temporary mitigations or workarounds exist for CVE-2021-27877 before patching?
[Mitigation] Immediately upgrade Veritas Backup Exec to version 21.2 or later, or restrict network access to the Agent port (default TCP 10000) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-27877
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (veritas)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.