CVE-2021-27877
Published: April 7, 2023
Official Description
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
CISA KEV Advisory
Veritas Backup Exec Agent Improper Authentication Vulnerability
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
Apply updates per vendor instructions.
Risk Analysis
This improper authentication vulnerability in Veritas Backup Exec (BE) Agent allows an attacker to gain unauthorized access using the SHA authentication scheme. The high severity, confirmed in-the-wild exploitation, and an EPSS score of 0.29375 signify that this is a critical and actively exploited security flaw.
This vulnerability is actively exploited in the wild and is included in CISA's KEV catalog.
Update Veritas Backup Exec Agent to a version that addresses the improper authentication vulnerability. Ensure strong authentication mechanisms are enforced for all backup agents and services.
Technical Analysis
CVE-2021-27877 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2021-27877 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2021-27877 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1