CVE-2021-27877: Veritas Backup Exec Agent Improper Authentication Vulnerability

CVE-2021-27877 is an improper authentication vulnerability in the Veritas Backup Exec Agent. It can allow an attacker to gain unauthorized access to the agent by abusing the SHA authentication scheme. Because Backup Exec agents commonly sit on systems that hold or can reach backup data, successful abuse can give an adversary a foothold for further movement or data access. CISA notes that this vulnerability has been used in ransomware activity, so organizations running the agent should treat it as a priority for inventory and remediation.

Public technical detail is limited to the CWE-287 classification and the CISA description; exact affected versions, CVSS scores, and exploit mechanics must be confirmed against the vendor advisory.

How it works

The flaw belongs to the improper authentication class (CWE-287). In products that implement authentication schemes such as SHA-based methods, a weakness can let an attacker bypass or subvert the intended checks. According to the CISA summary, an attacker can obtain unauthorized access to the Veritas Backup Exec Agent specifically via the SHA authentication scheme. Once authenticated to the agent, the attacker may be able to interact with it as a legitimate client would, depending on the privileges the agent process holds and the network reachability of the service. No further exploit mechanics are provided in the available facts; defenders should treat any unauthenticated or weakly authenticated network access to the agent as potentially abusable and verify details in the vendor advisory.

Am I affected? How to find it in your systems

Veritas Backup Exec Agents typically run on servers, workstations, or other endpoints that participate in backup jobs—often Windows systems, though confirm platform support with the vendor. They listen for connections from the Backup Exec media server or related management components and may be exposed on internal networks or, less commonly, to broader segments.

• Inventory: Query software inventory, package managers, or endpoint management tools for “Veritas Backup Exec Agent” or related Backup Exec components. Check services, installed programs, and process lists for agent-related binaries or service names.
• Version and configuration: Identify the installed agent version and whether the SHA authentication scheme is in use. Compare against the list of fixed versions in the vendor advisory; do not rely on assumed version ranges.
• Network exposure: Map which hosts have the agent listening and from which networks they are reachable. Look for management ports associated with Backup Exec agents in your environment documentation or by scanning internal ranges carefully.
• Telemetry and logs: Review agent and system logs for unexpected authentication successes, failed authentication spikes, or connections from unusual sources. Correlate with backup job schedules so that anomalous access outside normal windows stands out. Signs of exploitation may include unauthorized agent sessions or subsequent ransomware-related activity on the host.

If inventory is incomplete, treat any system known to run Backup Exec components as potentially in scope until verified.

How to remediate

Patch first. Apply the updates provided by Veritas for the Backup Exec Agent exactly as described in the vendor advisory and per CISA’s required action to apply updates per vendor instructions. After patching, restart the agent service if required and confirm the new version is running.

• Validate: Re-check inventory and version reporting to ensure all agents are updated. Test backup and restore functionality after the change.
• Hardening for this class: Prefer stronger authentication mechanisms where the product supports them; disable or restrict legacy or SHA-based schemes if the vendor guidance allows. Enforce least privilege on the account under which the agent runs. Limit network access to the agent so that only authorized Backup Exec servers can reach it.
• Ongoing: Include Backup Exec agents in regular vulnerability scanning and patch cycles. Monitor for new advisories that may supersede the current fix.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls.

• Segmentation: Isolate hosts running the agent so that only the necessary Backup Exec management servers can communicate with them. Block the agent’s listening ports from untrusted or user segments at the firewall or host firewall.
• Access control: Restrict which accounts and systems may initiate connections to the agent. Disable the agent service on systems that do not currently need backup coverage, if operationally acceptable.
• Virtual patching / monitoring: If a WAF or IPS is in the path, apply any vendor- or community-supplied signatures that address improper authentication to Backup Exec agents, after testing. Increase logging and alerting on authentication events and anomalous agent activity; feed relevant logs into your SIEM for correlation with ransomware indicators.
• Feature disablement: If the product allows disabling the SHA authentication scheme or switching to a stronger method without breaking required backups, do so under change control and document the temporary configuration.

These measures lower risk but do not replace the patch; schedule the official update as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities, including those with known ransomware use, can lead to unauthorized access and data compromise. If you discover evidence of exploitation or cannot rule out exposure of backup data or credentials, follow your incident response plan: isolate affected systems, preserve logs, and assess what data the agent could reach. You can also run a free exposure scan of your email addresses against known breach data to check whether related accounts appear in public breach corpora, then force password resets and enable multi-factor authentication where applicable.