CVE-2021-27876: Veritas Backup Exec Auth Bypass Flaw

CVE-2021-27876 Overview

CVE-2021-27876 is an authentication bypass vulnerability discovered in Veritas Backup Exec before version 21.2. The vulnerability resides in the SHA Authentication scheme used for communication between clients and the Backup Exec Agent. While the communication is typically secured over TLS, a flaw in the authentication mechanism allows attackers to gain unauthorized access and complete the authentication process without valid credentials. Once authenticated, an attacker can execute data management protocol commands and access arbitrary files on the system with System-level privileges.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Attackers can bypass authentication and access sensitive files with System privileges, potentially leading to complete system compromise.

Affected Products

• Veritas Backup Exec versions prior to 21.2

Discovery Timeline

• 2021-03-01 - CVE-2021-27876 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-27876

Vulnerability Analysis

The vulnerability exists in the SHA Authentication scheme implemented in Veritas Backup Exec Agent. The client-to-agent communication architecture relies on mutual authentication to establish trust before allowing data management operations. However, a flaw in the authentication implementation allows an attacker to successfully complete the authentication handshake without possessing valid credentials.

Once the attacker has bypassed authentication, they gain access to the data management protocol interface. This interface includes commands that accept file path parameters, and through crafted input parameters, an attacker can reference arbitrary file paths on the target system. The operations execute with System privileges, providing unrestricted access to any file on the compromised host.

This vulnerability is particularly dangerous in enterprise backup environments where Backup Exec agents are deployed across numerous systems. An attacker who exploits this vulnerability can potentially access backup data, configuration files, credentials, and other sensitive information stored on backup infrastructure.

Root Cause

The root cause is a weakness in the SHA Authentication scheme implementation. The authentication mechanism fails to properly validate the authentication parameters provided by the client, allowing an unauthenticated attacker to satisfy the authentication requirements and establish a trusted session with the Backup Exec Agent.

Attack Vector

The attack is network-based and requires low privileges to execute. An attacker with network access to the Backup Exec Agent can exploit the authentication bypass to gain unauthorized access. The attack sequence involves:

1. Establishing a connection to the Backup Exec Agent service
2. Exploiting the SHA Authentication vulnerability to bypass credential validation
3. Successfully completing the authentication handshake
4. Executing data management protocol commands with crafted file path parameters
5. Accessing arbitrary files with System privileges

The vulnerability has been documented in publicly available exploit code. Technical details are available through the Packet Storm exploit documentation.

Detection Methods for CVE-2021-27876

Indicators of Compromise

• Unusual authentication attempts to Backup Exec Agent services from unexpected source IPs
• File access patterns indicating reconnaissance or data exfiltration from backup infrastructure
• Unexpected data management protocol commands executed against Backup Exec Agents
• Authentication logs showing successful connections without corresponding valid credential usage

Detection Strategies

• Monitor network traffic to Backup Exec Agent ports for anomalous connection patterns
• Implement alerting on file access attempts to sensitive system files from Backup Exec processes
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process behavior on backup infrastructure
• Review authentication logs for Backup Exec services for irregularities

Monitoring Recommendations

• Enable verbose logging on Backup Exec Agent services to capture authentication events
• Implement network segmentation to restrict access to backup infrastructure from untrusted networks
• Deploy SentinelOne agents on systems running Backup Exec to detect exploitation attempts
• Configure SIEM rules to correlate authentication anomalies with file access events on backup servers

How to Mitigate CVE-2021-27876

Immediate Actions Required

• Upgrade Veritas Backup Exec to version 21.2 or later immediately
• Isolate Backup Exec Agent services from untrusted network segments until patching is complete
• Review access logs for signs of exploitation prior to patching
• Implement network access controls to limit which systems can communicate with Backup Exec Agents

Patch Information

Veritas has released patches addressing this vulnerability in Backup Exec version 21.2 and later. Organizations should prioritize patching due to the vulnerability's inclusion in the CISA Known Exploited Vulnerabilities catalog. The official security advisory is available at the Veritas Security Advisory VTS21-001.

Workarounds

• Implement strict network access controls to limit connectivity to Backup Exec Agent ports
• Deploy host-based firewalls on systems running Backup Exec Agents to restrict incoming connections
• Monitor for exploitation attempts using intrusion detection systems with signatures for this vulnerability
• Consider temporarily disabling external network access to Backup Exec services until patches can be applied

# Network firewall configuration example - restrict Backup Exec Agent access
# Allow only authorized backup servers to communicate with agents
iptables -A INPUT -p tcp --dport 10000 -s <authorized_backup_server_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 10000 -j DROP