Veritas Backup Exec Agent File Access Vulnerability (CVE-2021-27876)

What is affected, what to do

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Veritas Backup Exec Agent to version 21.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Veritas Backup Exec Agent lt *..21.2

Fixed in

• Veritas Backup Exec Agent 21.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade all Backup Exec Agents and media servers to version 21.2 or later per the Veritas advisory. The sibling CVEs 2021-27876/27877/27878 are fixed in the same release — partial patches do not close the chain.
   • Restrict Backup Exec Agent port TCP/10000 (NDMP) to known media servers only, via host firewall and perimeter ACL. Block any access from user VLANs, DMZ, or the internet immediately.
   • Audit internet exposure: external scans and Shodan/Censys queries for TCP/10000 against your own ASNs; treat any exposed agent as potentially compromised (invoke IR, verify backup-set integrity).
   • Disable the SHA authentication scheme in Backup Exec configuration where the infrastructure supports CRAM-MD5 or certificate-based variants, and enforce TLS mutual authentication between media server and agents.
   • Audit the Backup Exec Agent service account (typically SYSTEM/LocalSystem): review local admin scope on file servers, domain-admin delegations, and stored credentials; rotate anything the agent context could have touched.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: dedicated backup VLAN with strict ingress/egress ACLs; only media servers may initiate TCP/10000 to agents, no lateral path from workstations.
   • IPS/NDR: Suricata/Snort signature on NDMP connections from unknown sources; Suricata rule shape — alert tcp !$BACKUP_SERVERS any -> $BACKUP_AGENTS 10000 (msg:"Unauthorized NDMP to Backup Exec Agent"; flow:to_server,established; sid:1000027876;).
   • Endpoint hardening: install the Backup Exec Agent only on hosts that are actually backed up; use separate backup mechanisms on domain controllers and hypervisors to shrink blast radius.
   • IAM/least-privilege: migrate the agent service account from SYSTEM to a dedicated gMSA with minimal filesystem rights where technically feasible; no domain-admin membership.
   • Configuration hardening: review beremote.exe configuration, disable unneeded NDMP commands, raise logging to verbose so file accesses are auditable.
   • Immutable/offline backups: enforce 3-2-1-1 with at least one offline or WORM-protected copy — the KEV ransomware flag reflects attackers targeting backup destruction specifically.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek conn.log): new or rare source IPs on 10000/tcp to backup agents; KQL shape — NetworkCommunication | where DestPort == 10000 and DestIp in (BackupAgents) and SrcIp !in (BackupServers).
   • Sysmon EID 1 on agent hosts: beremote.exe as parent of unusual children (cmd.exe, powershell.exe, rundll32.exe) — never expected in normal operation.
   • Sysmon EID 11/file-create: beremote.exe writing files outside the normal backup-staging and log directories (e.g. C:\Windows\Temp\, C:\Users\Public\).
   • Windows Security EID 4663 on sensitive paths (C:\Windows\System32\config\SAM, NTDS.dit, web.config files) with access process beremote.exe — strong indicator of exploit use for credential exfiltration.
   • Veritas Backup Exec Agent logs (beremote.log): repeated authentication attempts from unknown clients, unexpected NDMP FH_ADD or file-access commands; Sigma shape on EventID = Authentication AND auth_scheme = SHA AND source_ip NOT IN known_media_servers.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Veritas Veritas Backup Exec Agent

References & sources

• veritas.comcontent/support/en_US/security/VTS21-001x_refsource_MISC, Vendor advisory
• packetstormsecurity.comfiles/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.ht…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27876government-resource, US government resource