Veritas Backup Exec Agent Command Execution Vulnerability (CVE-2021-27878)

What is affected, what to do

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Veritas Backup Exec Agent to version 21.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Veritas Backup Exec Agent lt *..21.2

Fixed in

• Veritas Backup Exec Agent 21.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Enumerate every host running the Backup Exec Remote Agent (Windows: "Backup Exec Remote Agent for Windows" service, beremote.exe; Linux/Unix: RALUS agent) and every Backup Exec server. Confirm versions from the BE server console or agent inventory. All versions before 21.2 are vulnerable.
   • Patch: Upgrade Backup Exec servers and all Remote Agents to 21.2 or later. Agents must be updated after the server upgrade, either by push install or manually; an upgraded server does not fix outdated agents. Check the Veritas vendor advisory for hotfix specifics.
   • Lock down TCP 10000 (NDMP) now: Allow inbound 10000/tcp on agent hosts only from Backup Exec media server IPs. Kill any exposure to the internet, user VLANs or VPN client pools immediately.
   • Compromise assessment: Hunt for child processes of beremote.exe on all agent hosts (see Detection rules), going back at least to the agent install date. On any hit, isolate the host and escalate per your IR plan, keeping the NIS2 24-hour early-warning deadline in mind.
   • Protect backup integrity: Ransomware use is confirmed, so verify that offline and immutable copies are intact. Air-gap or logically detach at least one backup set from the Backup Exec network until patching is complete.
   • Rotate credentials: If compromise is suspected, reset Backup Exec service accounts, stored BE logon accounts and local admin passwords on affected hosts.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move backup infrastructure into a dedicated management/backup VLAN. At host level, allow only the media servers: New-NetFirewallRule -DisplayName "BE Agent NDMP restrict" -Direction Inbound -Protocol TCP -LocalPort 10000 -RemoteAddress <MediaServerIP> -Action Allow, and block 10000/tcp from everything else.
   • IPS/NDR: Alert on NDMP from sources outside the media server allowlist, for example alert tcp !$BE_MEDIA_SERVERS any -> $BE_AGENTS 10000 (msg:"Unexpected NDMP to Backup Exec Agent"; flow:to_server,established; sid:...;). Enable the vendor IPS signatures for the publicly available exploit modules.
   • Endpoint hardening: Use EDR policy or ASR-style controls to block, or at minimum alert on, cmd.exe, powershell.exe, rundll32.exe and mshta.exe spawned by beremote.exe. The agent runs as SYSTEM, so any such child process means immediate full host control.
   • Attack-surface reduction: Uninstall the agent from hosts that are no longer backed up. On legacy systems that cannot reach 21.2, stop and disable the agent service until they are migrated.
   • IAM/least privilege: Do not run Backup Exec service accounts as Domain Admin. Scope their rights to the minimum required and deny interactive and RDP logon via GPO.
3. 03

   Runbook step 3

   Detection rules

   • EDR / Sysmon EID 1 / Security EID 4688: Look for process creation where ParentImage ends in \beremote.exe and Image is a shell or LOLBin. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "beremote.exe" | where FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","certutil.exe").
   • Network telemetry (Zeek conn.log / Suricata): Flag sessions to id.resp_p == 10000 from sources not on the media server allowlist. Internet, VPN-pool and workstation sources are especially suspicious.
   • Post-exploitation persistence: Correlate EID 7045 (service install), EID 4720/4732 (account created or added to Administrators) and Sysmon EID 11 (file drops in C:\Windows\Temp or C:\ProgramData) occurring shortly after NDMP sessions to agent hosts.
   • Linux/RALUS: Use auditd to catch execve calls whose parent is beremote (-a always,exit -F arch=b64 -S execve -k be_agent_exec). Alert on /bin/sh or /bin/bash spawned under the agent.
   • Ransomware precursors: Treat vssadmin delete shadows, wbadmin delete catalog or bcdedit /set recoveryenabled no on backup hosts as critical alerts that trigger auto-isolation.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.

Source: cvelistv5, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Veritas Veritas Backup Exec Agent

References & sources

• veritas.comcontent/support/en_US/security/VTS21-001x_refsource_MISC, Vendor advisory
• packetstormsecurity.comfiles/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.ht…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27878government-resource, US government resource