CVE-2021-27876

What it actually does

This vulnerability is an authentication bypass in Veritas Backup Exec versions before 21.2. Backup Exec Agent communications normally require successful authentication over TLS, but a flaw in the SHA authentication scheme allows an attacker with network access and limited prerequisites to complete the authentication process without valid authorization. After the connection is treated as authenticated, the attacker can issue data management protocol commands to the agent. By supplying crafted parameters to one of those commands, the attacker can access arbitrary files on the affected system with SYSTEM-level privileges, creating a high-impact confidentiality and integrity risk for backup servers and protected hosts.

Why it matters to the business

Successful exploitation can expose sensitive backup data, credentials, configuration files, and operating system files from systems running affected Backup Exec components. Because backup infrastructure often has broad access across an organization, compromise can support lateral movement, data theft, destruction of recoverability, and ransomware operations. This issue is listed in CISA KEV, is associated with ransomware use, and had a CISA remediation deadline of 2023-04-28, so unpatched systems should be treated as high-priority exposure even though the vulnerability is older. The operational impact is especially serious because backup platforms are frequently relied upon during incident recovery.

How an attack unfolds

An attacker first identifies a reachable Veritas Backup Exec Agent service, commonly on backup-management or protected-client systems. The attacker initiates the normal client-to-agent communication flow but abuses the vulnerable SHA authentication scheme to make the agent accept the session as authenticated. Once accepted, the attacker sends Backup Exec data management protocol commands over the trusted connection. A crafted parameter in one command references a file path outside the intended scope, allowing the attacker to access arbitrary files using the privileges of the Backup Exec Agent service, typically SYSTEM on Windows. In real intrusions, this access can be used to harvest credentials or configuration data, identify backup repositories, weaken recovery capability, and support ransomware deployment or data-extortion activity.

How to fix it

Upgrade Veritas Backup Exec to version 21.2 or later, or to the latest supported release available from Veritas. If immediate upgrade is not possible, restrict network access to Backup Exec Agent services to only trusted backup servers and management networks, block exposure from the internet, and enforce host-based firewall rules around Backup Exec ports and services. Review Veritas advisories for any companion fixes because this vulnerability has been discussed alongside other Backup Exec Agent flaws. Ensure backup servers and agents are included in vulnerability management, endpoint detection, and privileged-access monitoring programs. Rotate credentials that may have been accessible from affected systems if exploitation is suspected.

How to confirm the fix worked

Confirm all Backup Exec servers and agents report version 21.2 or later, preferably the latest supported build. Inventory systems running Backup Exec services and verify no affected agent is reachable from untrusted networks. Use vulnerability scanners or authenticated software inventory to detect versions before 21.2. Validate firewall controls by confirming Backup Exec Agent ports are reachable only from authorized backup infrastructure. After patching, restart relevant Backup Exec services where required and confirm backup and restore jobs still operate normally. For systems that were exposed before remediation, perform compromise assessment rather than assuming patching alone removes prior risk.

Typical attack path

1. Scan for internet-exposed or internally reachable Veritas Backup Exec Agent services.
2. Confirm the target is running an affected Backup Exec version before 21.2 or an unverified legacy deployment.
3. Establish a client-to-agent connection and manipulate the vulnerable SHA authentication exchange.
4. Obtain an authenticated agent session without valid authorization.
5. Send data management protocol commands using crafted file-path parameters.
6. Read or access sensitive local files with SYSTEM privileges.
7. Use recovered data, credentials, or backup knowledge to support lateral movement, data theft, backup disruption, or ransomware activity.

How to detect it

Review Backup Exec Agent and server logs for unusual client connections, failed or abnormal authentication events, unexpected data management protocol activity, and file access requests that reference sensitive system paths or path traversal patterns. Correlate with firewall, VPN, proxy, EDR, and Windows event logs for connections to Backup Exec services from unauthorized hosts, especially around TCP ports commonly used by Backup Exec Agent components. Investigate any Backup Exec process accessing unusual files such as Windows registry hives, credential stores, backup catalogs, security databases, or files outside expected backup job scopes. On Windows, review process activity for Backup Exec service processes such as beremote.exe performing unexpected file reads, network connections, or child-process creation. Because this vulnerability is KEV-listed and associated with ransomware, also hunt for follow-on behavior including credential dumping, backup deletion, backup job tampering, mass file encryption, suspicious archive creation, and outbound data transfer after Backup Exec Agent access.

• beremote.exe
• beserver.exe
• bengine.exe
• C:\Program Files\Veritas\Backup Exec\RAWS\beremote.exe
• C:\Program Files\Veritas\Backup Exec\Logs\
• C:\Program Files\Veritas\Backup Exec\RAWS\Logs\
• C:\Program Files\Symantec\Backup Exec\RAWS\beremote.exe
• C:\Program Files\Symantec\Backup Exec\Logs\
• TCP/10000
• TCP/6101
• ..\
• ../
• C:\Windows\System32\config\SAM
• C:\Windows\System32\config\SYSTEM
• C:\Windows\System32\config\SECURITY
• C:\Windows\NTDS\ntds.dit

What your security team should do

• Immediately inventory all Veritas Backup Exec servers and agents, including legacy protected clients and decommissioned backup hosts that may still run services.
• Patch or upgrade all affected installations to Backup Exec 21.2 or later, preferably the latest supported version.
• Prioritize remediation for any Backup Exec service reachable from the internet, broad internal networks, VPN users, or unmanaged segments.
• Treat unpatched exposure as high risk because the vulnerability is in CISA KEV and is associated with ransomware activity.
• Restrict Backup Exec Agent network access to authorized backup servers using firewalls, ACLs, and segmentation.
• Review Backup Exec server and agent logs, EDR telemetry, and network records for suspicious authentication, command execution, and unusual file access activity.
• Rotate privileged credentials and backup-related service credentials if logs suggest unauthorized access or if the system was internet-exposed while vulnerable.
• Verify backup integrity and recovery readiness, including offline or immutable backups, because ransomware operators often target backup infrastructure.
• Monitor for suspicious access to sensitive files such as registry hives, credential stores, backup catalogs, configuration files, and scripts on systems running Backup Exec services.