{"id":"CVE-2021-27876","published":"2021-03-01T22:15:14Z","modified":"2026-06-17T03:45:32Z","title":"Veritas Backup Exec Agent File Access Vulnerability","vendor":"Veritas","product":"Backup Exec Agent","tier":"core","eol":null,"description":{"text":"An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.","provenance":"source","from":"NVD"},"summary":{"text":"The Veritas Backup Exec Agent contains a flaw in its SHA Authentication scheme, which is used during client-to-Agent communication after the TLS session is established, allowing an attacker to bypass authentication. A network-reachable attacker who already holds low-privilege credentials can authenticate through this weakness, then send data management protocol commands with crafted parameters to read arbitrary files on the system with System privileges, without any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:59:54Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.13518,"percentile":0.96441,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-04-07","dueDate":"2023-04-28","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27876","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-03","exploitedFirstSeen":"2023-04-03","ransomware":true,"evidence":[{"url":"https://www.mandiant.com/resources/blog/alphv-ransomware-backup","date":"2023-04-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-04-07"},{"url":"https://www.at-bay.com/articles/avoslocker-adds-veritas-vulnerabilities-to-access-arsenal/","date":"2023-06-01"},{"url":"https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","date":"2023-09-14"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://blog.talosintelligence.com/talos-ir-quarterly-trends-q1-2024/","date":"2024-04-25"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-attacks-surge-rely-on-public-legitimate-tools","date":"2024-06-03"},{"url":"https://redalert.nshc.net/2024/07/26/the-activities-summary-of-ransomware-threat-actors-in-2023-kor/","date":"2024-07-26"},{"url":"https://redalert.nshc.net/2024/08/21/summary-of-ransomware-threat-actor-activity-in-2023-eng/","date":"2024-08-21"},{"url":"https://redalert.nshc.net/2024/09/19/summary-of-ransomware-threat-actor-activity-in-2023-jpn/","date":"2024-09-19"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.veritas.com/content/support/en_US/security/VTS21-001#issue2","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.veritas.com/content/support/en_US/security/VTS21-001#issue2","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27876","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: network service authentication bypass via SHA scheme","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"an attacker is able to gain unauthorized access and complete the authentication process","start":272,"end":359}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary file access with System privileges","mappingType":"primary_impact","evidence":[{"from":"description","quote":"an attacker can access an arbitrary file on the system using System privileges","start":525,"end":603}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-14614","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14614","exploited":true,"exploitedSince":"2023-04-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2026-06-18","earliestUrl":"https://github.com/wingerbijay/CVE-2021-27876","repos":[{"name":"wingerbijay/CVE-2021-27876","url":"https://github.com/wingerbijay/CVE-2021-27876","stars":1,"created":"2026-06-18"},{"name":"hyderpwn/veritas-backup","url":"https://github.com/hyderpwn/veritas-backup","stars":1,"created":"2026-08-27"}]},"metasploit":[{"name":"Veritas Backup Exec Agent Remote Code Execution","module":"exploit/multi/veritas/beagent_sha_auth_rce","type":"exploit","disclosureDate":"2021-03-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb"}],"first":{"date":"2021-03-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2021-03-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27876","provenance":"source"},{"date":"2021-03-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2026-06-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb","provenance":"source"},{"date":"2023-04-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.mandiant.com/resources/blog/alphv-ransomware-backup","provenance":"source"},{"date":"2023-04-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-04-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14614","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":767},"priority":{"score":78.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1305 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.29,"detail":"percentile 0.9644"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}