Veritas Backup Exec Agent Authentication Bypass and Remote Code Execution Vulnerability Advisory (CVE-2021-27878)
Executive & SecOps Summary
SECOPS ASSESSMENTVeritas Backup Exec versions prior to 21.2 (Remote Agent)
Attackers can bypass authentication via flaws in the SHA authentication scheme and execute arbitrary commands with SYSTEM privileges
Immediately upgrade Veritas Backup Exec to version 21.2 or later, and restrict external access to the NDMP port (TCP 10000)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading the Veritas Backup Exec infrastructure to version 21.2 or later. Use the following PowerShell commands to stop the agent service, apply the patch, and restart the service on Windows hosts:
# Check and stop the Backup Exec Agent service
Get-Service -Name 'BackupExecAgentAccelerator' | Stop-Service -Force
# Execute the Veritas official patch installer silently
Start-Process -FilePath 'C:\Patches\Veritas_Backup_Exec_21.2_Patch.exe' -ArgumentList '/silent /qn' -Wait
# Restart and verify the service status
Start-Service -Name 'BackupExecAgentAccelerator'
Get-Service -Name 'BackupExecAgentAccelerator'2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the NDMP port (default TCP 10000) using firewall rules. Below is an example of restricting NDMP access to a trusted backup master server IP using Windows Advanced Firewall:
# Block all external inbound traffic to NDMP port 10000
New-NetFirewallRule -DisplayName 'Block_NDMP_External' -Direction Inbound -LocalPort 10000 -Protocol TCP -Action Block -RemoteAddress Internet
# Allow inbound NDMP traffic only from the trusted Backup Master Server (e.g., 192.168.10.50)
New-NetFirewallRule -DisplayName 'Allow_NDMP_Backup_Master' -Direction Inbound -LocalPort 10000 -Protocol TCP -Action Allow -RemoteAddress 192.168.10.503. Log Audit & IoC Verification Commands
Run the following commands to audit the listening ports and verify the installed version of the Backup Exec Agent on your endpoints:
# On Linux Agent hosts, check if port 10000 is exposed publicly
netstat -antp | grep 10000
# On Windows hosts, query the registry to verify the installed Backup Exec version
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Veritas\Backup Exec\*' | Select-Object -Property Version, InstallDirBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-27878) is an authentication bypass flaw residing in the SHA Authentication scheme of the Veritas Backup Exec Agent. While communication between the client and the Agent is designed to establish secure TLS-encrypted channels requiring robust authentication, a logical flaw in the legacy SHA authentication handler allows an attacker to successfully complete the authentication handshake without possessing valid credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the exploit by sending a specially crafted authentication request to the NDMP (Network Data Management Protocol) service listening on TCP port 10000. Due to improper validation within the SHA authentication routine, the Agent incorrectly validates the malicious handshake, granting the attacker an authenticated state. Once authenticated, the attacker can issue arbitrary NDMP data management commands, including specific administrative commands that trigger arbitrary OS command execution under the context of local SYSTEM privileges.
3. Infrastructure & Business Impact
With a CVSS score of 8.8 and its inclusion in the CISA KEV catalog, this vulnerability is actively exploited in the wild, often as an initial entry point or lateral movement vector for ransomware campaigns. Because backup agents possess high-level privileges to access and manage sensitive enterprise data, compromise of this service poses an extreme risk of data exfiltration, backup destruction, and complete domain-wide infrastructure compromise.
Official Vendor Advisories & References
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.
Frequently Asked SecOps Questions (CVE-2021-27878)
FAQQ1. How critical is CVE-2021-27878 and is it actively exploited in the wild?
CVE-2021-27878 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 23.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-27878?
Primary impacted vendors include veritas across backup_exec, backup_exec_agent. Scope summary: Veritas Backup Exec versions prior to 21.2 (including Windows and Linux Remote Agents)
Q3. What temporary mitigations or workarounds exist for CVE-2021-27878 before patching?
[Mitigation] Immediately upgrade Veritas Backup Exec to version 21.2 or later, and restrict external access to the NDMP port (TCP 10000) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-27878
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (veritas)
View Category →Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.