CVE-2021-27876: Veritas Backup Exec Auth Bypass Flaw

CVE-2021-27876 Overview

CVE-2021-27876 is an authentication bypass and arbitrary file access vulnerability in Veritas Backup Exec Agent versions before 21.2. The flaw resides in the SHA Authentication scheme used between the Backup Exec client and the Agent. An attacker can complete the authentication handshake without valid credentials and then issue data management protocol commands over the authenticated session. Crafted command parameters allow the attacker to read arbitrary files from the target system under SYSTEM privileges. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog after observing in-the-wild exploitation, including activity attributed to ransomware operators.

Critical Impact

Remote attackers can bypass agent authentication and access arbitrary files with SYSTEM privileges, exposing backup data, credentials, and configuration files across enterprise environments.

Affected Products

• Veritas Backup Exec Agent versions prior to 21.2
• Deployments using the SHA Authentication scheme between client and Agent
• Windows hosts running the Backup Exec Agent service with SYSTEM privileges

Discovery Timeline

• 2021-03-01 - CVE-2021-27876 published to NVD
• 2021-03-01 - Veritas publishes Security Advisory VTS21-001
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-27876

Vulnerability Analysis

The vulnerability stems from a logic flaw in the SHA-based authentication scheme used by the Veritas Backup Exec Agent. Communication between a client and an Agent normally occurs over TLS and requires successful authentication. The defect in the authentication routine lets an attacker complete the handshake without proving knowledge of valid credentials. Once authenticated, the attacker controls a privileged channel to the Agent service.

After authentication, the client can submit data management protocol (NDMP-style) commands to the Agent. One of these commands accepts file path parameters that are not properly validated. By supplying crafted parameters, the attacker reads arbitrary files on the host. Because the Agent runs as SYSTEM, the read scope includes registry hives, the Security Account Manager (SAM) database, backup catalogs, and credential material. This vulnerability is tracked under [CWE-noinfo] in NVD and is listed on the CISA KEV catalog.

Root Cause

The SHA Authentication implementation fails to enforce a binding between the cryptographic challenge and the asserted client identity. An unauthenticated network attacker who can reach the Agent's listening port can manipulate the protocol exchange and be treated as an authenticated peer. The subsequent command parser does not sanitize file path inputs before performing read operations.

Attack Vector

Exploitation requires network reachability to the Backup Exec Agent service, typically TCP port 10000. The attacker establishes a TLS session, completes the flawed SHA authentication exchange, and issues file access commands containing attacker-controlled paths. No user interaction is required. Public exploit code was published on Packet Storm as the "Veritas Backup Exec Agent Remote Code Execution" module, and the same authentication bypass primitive has been chained into remote code execution by ransomware affiliates.

No verified code examples are available. See the Packet Storm Exploit Report and the Veritas Security Advisory VTS21-001 for protocol-level details.

Detection Methods for CVE-2021-27876

Indicators of Compromise

• Inbound connections to TCP port 10000 on Backup Exec Agent hosts from unexpected internal or external sources
• Unusual beremote.exe child processes or file read activity targeting C:\Windows\System32\config\ or backup catalog directories
• Agent log entries showing successful authentication followed by anomalous NDMP command sequences
• Outbound data transfers from Backup Exec servers to non-corporate destinations shortly after Agent connections

Detection Strategies

• Monitor Backup Exec Agent logs for authentication events that lack a matching legitimate backup job schedule
• Alert on Backup Exec Agent processes accessing sensitive system files outside of declared backup selection lists
• Hunt for the public Metasploit module signature against TCP 10000 using network IDS rules
• Cross-reference Agent service activity with Active Directory authentication events to identify spoofed sessions

Monitoring Recommendations

• Enable verbose logging on the Backup Exec Agent service and forward events to a centralized SIEM
• Track network flows to and from Backup Exec infrastructure and baseline normal peers
• Inventory all hosts running the Backup Exec Agent and confirm version reporting on a recurring schedule

How to Mitigate CVE-2021-27876

Immediate Actions Required

• Upgrade Veritas Backup Exec to version 21.2 or later on all servers and Agents
• Restrict network access to TCP port 10000 so only authorized Backup Exec media servers can reach Agents
• Audit Backup Exec service accounts and rotate credentials that may have been exposed
• Review historical Agent logs for evidence of unauthorized authentication or file access

Patch Information

Veritas resolved CVE-2021-27876 in Backup Exec 21.2. The fix is documented in Veritas Security Advisory VTS21-001. Apply the patch to both the Backup Exec server and all remote Agents, since mixed-version deployments remain exposed when legacy Agents are reachable. After patching, verify that the SHA Authentication scheme is disabled or replaced per vendor guidance.

Workarounds

• Place Backup Exec Agent hosts on isolated management VLANs accessible only to authorized media servers
• Apply host-based firewall rules to limit inbound connections on TCP 10000 to known media server IP addresses
• Disable the Backup Exec Agent service on hosts that no longer require backup operations
• Require IPsec or VPN tunneling between media servers and Agents to limit exposure on flat networks

# Configuration example: Windows firewall rule restricting Backup Exec Agent access
netsh advfirewall firewall add rule name="Restrict Backup Exec Agent" \
  dir=in action=allow protocol=TCP localport=10000 \
  remoteip=<MEDIA_SERVER_IP> profile=domain

netsh advfirewall firewall add rule name="Block Backup Exec Agent Default" \
  dir=in action=block protocol=TCP localport=10000