ACTIVELY EXPLOITED
CVE-2021-27877: Veritas Backup Exec Agent Improper Authentication Vulnerability
| Vendor | Veritas |
|---|---|
| Product | Backup Exec Agent |
| Actively exploited | Yes |
| Added to CISA KEV | 7 Apr 2023 |
| CISA federal deadline | 28 Apr 2023 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-287 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
SOURCES
Other Veritas flaws
- CVE-2021-27878: Veritas Backup Exec Agent Command Execution Vulnerability
- CVE-2021-27876: Veritas Backup Exec Agent File Access Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.