Veritas Backup Exec Agent Improper Authentication Vulnerability (CVE-2021-27877)

What is affected, what to do

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Veritas Backup Exec Agent to version 21.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Veritas Backup Exec Agent lt *..21.2

Fixed in

• Veritas Backup Exec Agent 21.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every host running a Backup Exec Agent (Remote Agent for Windows/Linux, process beremote.exe) and every Backup Exec server, including leftover installs on decommissioned systems. Check versions — everything before 21.2 is affected.
   • Patch: Upgrade the Backup Exec server and all agents to version 21.2 or later, which disables the legacy SHA authentication scheme. Agents must be updated separately (push install) — upgrading only the server leaves the hole open. Look up the exact build in the vendor advisory.
   • Kill external exposure now: Block the agent/NDMP port TCP 10000 at the perimeter and on VPN/partner boundaries, then confirm with an external scan (e.g. nmap -p 10000) that no agent is reachable from the internet or untrusted segments.
   • Compromise assessment: On every previously unpatched agent host, hunt for child processes of beremote.exe (shells, scripts, remote-access tools) plus newly created services and accounts (see detection rules). On a hit, isolate the host and trigger your IR process, including NIS2/regulatory notification timelines.
   • Rotate credentials: Reset Backup Exec service accounts and stored logon accounts where an agent was exposed or shows indicators — the agent runs as SYSTEM/root.
   • Protect backup integrity: Ensure at least one recent backup set is offline or immutable (WORM) before any restore activity; check catalogs for deleted jobs or media.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Restrict TCP 10000 on agent hosts via host firewall to the IPs of the responsible media servers only. Windows example: New-NetFirewallRule -DisplayName "BE Agent restrict" -Direction Inbound -Protocol TCP -LocalPort 10000 -RemoteAddress <MediaServer-IP> -Action Allow, plus an explicit deny for all other sources.
   • Dedicated backup network: Move backup traffic into its own VLAN/management segment; block east-west traffic on port 10000 between client systems via internal firewalling or micro-segmentation.
   • IPS signatures: Enable your IPS/NGFW vendor signatures for CVE-2021-27877 / Backup Exec agent authentication bypass on NDMP traffic (TCP 10000) in blocking mode; alert on any NDMP session from a non-media-server source.
   • Reduce attack surface: Uninstall agents from systems no longer protected; disable the "Backup Exec Remote Agent for Windows" service where no active job exists.
   • Endpoint hardening: EDR rule or ASR/AppLocker policy that blocks or at minimum alerts on cmd.exe, powershell.exe, rundll32.exe or mshta.exe spawned by beremote.exe.
   • Backup resilience: Separate the Backup Exec server from the production domain (dedicated admin forest or local accounts), enforce MFA for backup administration, and use immutable storage targets.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / Security EID 4688): beremote.exe spawning shells or LOLBins. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "beremote.exe" and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","certutil.exe","bitsadmin.exe","mshta.exe")
   • Network telemetry (Zeek conn.log / Suricata / firewall): Inbound connections to TCP 10000 from sources outside the media-server allowlist. SPL: index=zeek sourcetype=conn id.resp_p=10000 NOT id.orig_h IN (<MediaServer-IPs>) | stats count by id.orig_h, id.resp_h
   • File activity (Sysmon EID 11): beremote.exe writing executables or scripts (.exe, .dll, .ps1, .bat) into C:\Windows\Temp, C:\ProgramData or user profiles — indicates tool staging.
   • Persistence (System EID 7045 / Security EID 4720, 4732): New services or new local admin accounts shortly after NDMP connections to an agent host; correlate within a ~15-minute window.
   • Linux agents (auditd): execve events whose parent is beremote or a process under /opt/VRTSralus/ — Sigma shape: logsource: linux/auditd; selection: type=EXECVE, ppid_comm=beremote.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Veritas Veritas Backup Exec Agent

References & sources

• veritas.comcontent/support/en_US/security/VTS21-001x_refsource_MISC, Vendor advisory
• packetstormsecurity.comfiles/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.ht…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27877government-resource, US government resource