CVE-2021-27878: Veritas Backup Exec Agent Command Execution Vulnerability

CISA Known Exploited Vulnerabilities

Name

Veritas Backup Exec Agent Command Execution Vulnerability

Vendor

Veritas

Product

Backup Exec Agent

Added to the catalog

2023-04-07

Due date for US federal agencies

2023-04-28

Weaknesses

CWE-287

Catalog version

2026.10.30

Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA marks this vulnerability as known to be used in ransomware campaigns. CISA does not say which group used it.

Links in CISA's notes

• https://www.veritas.com/support/en_US/security/VTS21-001
• https://nvd.nist.gov/vuln/detail/CVE-2021-27878

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2021-03-01T22:15:14.537

Last modified

2026-06-17T03:45:33.063

Weaknesses

NVD-CWE-noinfo

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.

References

• http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html (Exploit, Third Party Advisory, VDB Entry)
• https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3 (Vendor Advisory)
• http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html (Exploit, Third Party Advisory, VDB Entry)
• https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3 (Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27878 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:51.476Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-27878

CVE record

Assigner

mitre

State

PUBLISHED

Published

2021-03-01T21:49:24.000Z

Updated

2025-10-21T23:25:53.483Z

Problem types

n/a

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.

References

• https://www.veritas.com/content/support/en_US/security/VTS21-001#issue3
• http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html

Read on 2026-11-03T01:07:12.295Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27878.json