CVE-2021-27877

What it actually does

CVE-2021-27877 is a network-exploitable authentication bypass in Veritas Backup Exec before version 21.2. Backup Exec Agents retained support for a deprecated SHA-based authentication scheme that was no longer intended for use. A remote, unauthenticated attacker can abuse that legacy authentication path to gain unauthorized access to the Backup Exec Agent and execute privileged commands in the agent’s security context, potentially leading to full compromise of the protected host.

Why it matters to the business

Compromise of backup infrastructure is high impact because Backup Exec Agents often run with elevated privileges and have access to critical servers and backup data. Successful exploitation can let attackers disable backups, tamper with restore capability, steal sensitive data, deploy ransomware, or use backup servers as a foothold for broader compromise. This vulnerability is listed in CISA KEV, has been exploited in the wild, and is associated with ransomware activity, so unpatched internet-facing or broadly reachable Backup Exec deployments should be treated as urgent remediation priorities. The CISA remediation deadline was 2023-04-28, meaning any remaining exposure is materially overdue.

How an attack unfolds

An attacker first identifies systems exposing Veritas Backup Exec Agent services, commonly through network scanning or prior access to an internal network. The attacker then connects to the agent service and negotiates or invokes the obsolete SHA authentication mechanism that remained enabled in affected versions. Because the legacy authentication path is improperly enforced, the attacker can obtain unauthorized agent access without valid credentials. Once accepted by the agent, the attacker can issue privileged commands through the Backup Exec Agent interface. In real-world intrusions, this level of access can be chained with credential theft, lateral movement, backup deletion or tampering, and ransomware deployment, especially where Backup Exec components are reachable from untrusted networks or flat internal segments.

How to fix it

Upgrade Veritas Backup Exec and all Backup Exec Agents to version 21.2 or later, or to the latest vendor-supported release available for the deployed branch. Ensure all remote agents are upgraded, not only the central Backup Exec server. If immediate upgrade is not possible, restrict network access to Backup Exec services to trusted backup servers and administrative hosts only, block internet exposure, segment backup infrastructure from general user and server networks, and monitor or disable deprecated authentication mechanisms where vendor-supported. Review Backup Exec service accounts and agent privileges, rotate credentials associated with backup operations, and validate that backup repositories and restore points have not been tampered with.

How to confirm the fix worked

Confirm installed Backup Exec server and agent versions are 21.2 or later across all systems. Use authenticated asset inventory, software management tooling, or Veritas administration consoles to identify any remaining pre-21.2 installations. Validate network exposure by scanning for reachable Backup Exec Agent services from untrusted network segments and the internet. Confirm firewall rules allow Backup Exec Agent access only from authorized backup infrastructure. Perform a controlled vendor-approved connectivity or vulnerability assessment to verify the deprecated SHA authentication path is no longer accepted. Also confirm backup and restore operations still function after patching, and test at least one restore from known-good backup media or repositories.

Typical attack path

1. Discover Veritas Backup Exec Agent services exposed on internal or external networks.
2. Confirm the target is running an affected Backup Exec version prior to 21.2.
3. Connect to the Backup Exec Agent service and attempt use of the deprecated SHA authentication scheme.
4. Bypass authentication and obtain unauthorized privileged access to the agent.
5. Execute commands through the agent service context on the target host.
6. Disable or manipulate backup services, stage tools, dump credentials, move laterally, or deploy ransomware.

How to detect it

To determine whether exploitation already occurred, review Backup Exec server and agent logs, Windows Event Logs, EDR telemetry, Sysmon logs, firewall logs, and network flow data for unexpected inbound connections to Backup Exec Agent services, especially from internet addresses, user workstations, VPN pools, or non-backup servers. Focus on periods before patching and on hosts running versions earlier than 21.2. Hunt for Backup Exec Agent processes spawning command shells, scripting engines, credential tools, file transfer utilities, or ransomware-like processes. In Windows telemetry, investigate process trees where beremote.exe or other Backup Exec services launch cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, vssadmin.exe, wbadmin.exe, bcdedit.exe, or net.exe. Review Backup Exec administrative logs for unexpected authentication attempts, configuration changes, job deletions, disabled schedules, failed backups, deleted catalogs, modified retention settings, or anomalous restore/export activity. Network teams should search for scans and repeated connections to Backup Exec Agent ports, particularly TCP/10000 where used. Because this vulnerability has been associated with ransomware activity, also hunt for shadow copy deletion, backup repository deletion, mass file renames, security service stoppage, and lateral movement following suspicious agent access.

• beremote.exe
• C:\Program Files\Veritas\Backup Exec\RAWS\beremote.exe
• Backup Exec Remote Agent for Windows
• TCP/10000
• ParentImage=*\beremote.exe Image=*\cmd.exe
• ParentImage=*\beremote.exe Image=*\powershell.exe
• ParentImage=*\beremote.exe Image=*\wscript.exe
• ParentImage=*\beremote.exe Image=*\cscript.exe
• ParentImage=*\beremote.exe Image=*\rundll32.exe
• ParentImage=*\beremote.exe Image=*\regsvr32.exe
• ParentImage=*\beremote.exe Image=*\certutil.exe
• ParentImage=*\beremote.exe Image=*\bitsadmin.exe
• ParentImage=*\beremote.exe Image=*\vssadmin.exe
• ParentImage=*\beremote.exe Image=*\wbadmin.exe
• ParentImage=*\beremote.exe Image=*\bcdedit.exe
• vssadmin.exe Delete Shadows
• wbadmin.exe delete catalog
• bcdedit.exe /set {default} recoveryenabled No
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

What your security team should do

• Immediately identify all Veritas Backup Exec servers and agents, prioritizing internet-facing systems and systems reachable from broad internal networks.
• Upgrade Backup Exec and all agents to version 21.2 or later, preferably the latest supported release.
• Treat unpatched systems as potentially compromised because the vulnerability is in CISA KEV, exploited in the wild, and associated with ransomware campaigns.
• Restrict Backup Exec Agent network access to authorized backup servers and administrative jump hosts only.
• Review EDR, Windows, firewall, and Backup Exec logs for evidence of suspicious access to agent services and command execution by Backup Exec processes.
• Look for ransomware preparation activity such as backup deletion, shadow copy deletion, security tool tampering, and unexpected service stops.
• Rotate credentials used by Backup Exec services and administrators if exposure or suspicious activity is found.
• Validate backup integrity and perform restore testing before assuming recovery capability is intact.