CVE-2021-27878

What it actually does

CVE-2021-27878 is an authentication-bypass vulnerability in Veritas Backup Exec versions before 21.2 affecting the SHA-based authentication scheme used between Backup Exec clients and agents. A network attacker who can reach the Backup Exec agent service can improperly complete authentication and then issue data-management protocol commands over the authenticated connection. One available command path allows arbitrary operating-system command execution with SYSTEM-level privileges, resulting in full compromise of the affected Backup Exec host.

Why it matters to the business

Compromise of Backup Exec infrastructure is especially severe because backup servers and agents often have broad access to production systems and backup data. Successful exploitation can let attackers take over backup hosts, disable or destroy backups, steal sensitive backed-up data, and support ransomware operations. This vulnerability is listed in CISA KEV, has been observed in active exploitation, and is associated with ransomware use, so unpatched Backup Exec deployments should be treated as high-priority exposure even though the vulnerability is older.

How an attack unfolds

An attacker first identifies a reachable Veritas Backup Exec agent, commonly by scanning for Backup Exec/remote-agent services such as the NDMP-style agent listener. The attacker initiates a client-to-agent session and abuses the vulnerable SHA authentication workflow to complete authentication without proper authorization. Once the connection is accepted as authenticated, the attacker sends Backup Exec data-management protocol commands. By invoking a command path that reaches the operating system, the attacker causes the agent process to launch arbitrary commands under SYSTEM privileges. From there, the attacker can create users, deploy malware, dump credentials, move laterally, tamper with backups, or stage ransomware. Because backup infrastructure is trusted and highly privileged, exploitation can rapidly escalate from a single exposed agent to broader operational compromise.

How to fix it

Upgrade Veritas Backup Exec to version 21.2 or later, or to the latest vendor-supported release containing the security fix. If immediate upgrade is not possible, restrict network access to Backup Exec agent services so only authorized Backup Exec servers and management hosts can connect; block exposure to the Internet and untrusted networks. Disable Backup Exec remote-agent services on systems where they are not required. Review firewall rules for Backup Exec-related ports, especially TCP/10000 where the Backup Exec Remote Agent/NDMP-style service is commonly exposed. Because this issue is in CISA KEV and has ransomware association, mitigation should not be considered a long-term substitute for patching. After remediation, rotate credentials used by Backup Exec and related service accounts if compromise is suspected, validate backup integrity, and ensure offline or immutable backups are available.

How to confirm the fix worked

Confirm every Backup Exec server and agent is running version 21.2 or later, or another vendor-confirmed fixed release. Use the product console, installed-program inventory, package management records, file-version checks, or endpoint management tooling to identify any Backup Exec installations older than 21.2. Verify that Backup Exec remote-agent services are not reachable from the Internet or untrusted network segments by performing controlled port scans and firewall-rule reviews. Confirm only approved Backup Exec servers can connect to agent services. On Windows systems, verify the Backup Exec Remote Agent service binaries have been updated and restarted after patching. Validate that backup and restore jobs still function after upgrade, and perform a test restore to confirm operational recovery capability.

Typical attack path

1. Scan for Internet-facing or internally reachable Veritas Backup Exec agent services, especially systems exposing Backup Exec remote-agent ports such as TCP/10000.
2. Confirm the target is running a vulnerable Backup Exec version earlier than 21.2.
3. Start a Backup Exec client-to-agent communication session.
4. Abuse the flawed SHA authentication scheme to complete authentication without valid authorization.
5. Send authenticated data-management protocol commands to the agent.
6. Trigger arbitrary command execution through the vulnerable command path.
7. Run commands as SYSTEM to establish persistence, disable security tools, access backup data, or deploy ransomware.
8. Use the compromised backup host or agent as a pivot point to reach additional systems and protected data.

How to detect it

To determine whether this vulnerability was already exploited, focus on Backup Exec agent hosts and backup servers. Review Windows process creation telemetry such as Security Event ID 4688, Sysmon Event ID 1, and EDR process trees for Backup Exec agent processes spawning command shells, scripting tools, discovery utilities, credential-access tools, or backup-deletion utilities. Review service-installation and persistence events such as Windows System Event ID 7045, Security Event ID 4697, scheduled task events, registry run keys, and new local administrator accounts created shortly after inbound Backup Exec connections. Inspect authentication logs for unusual network logons to Backup Exec systems, especially Security Event ID 4624 Type 3 from unfamiliar hosts before suspicious process activity. Review firewall, NetFlow, proxy, and packet-capture data for unexpected inbound connections to Backup Exec agent services, particularly TCP/10000, from non-backup infrastructure. Review Veritas Backup Exec logs and Remote Agent logs for unexpected client connections, authentication anomalies, failed or unusual backup operations, unexpected restore/export jobs, and agent-command activity. Because exploitation can lead to ransomware, also hunt for commands and artifacts associated with backup destruction or recovery inhibition, including vssadmin shadow-copy deletion, wbadmin catalog deletion, bcdedit recovery changes, mass file encryption, security-tool tampering, and sudden backup job failures. If known ransomware groups or intrusion sets are suspected, correlate Backup Exec exploitation timing with lateral movement, credential dumping, remote service creation, and data staging activity across the environment.

• TCP/10000 inbound to Veritas Backup Exec agent hosts from non-backup systems
• beremote.exe
• C:\Program Files\Veritas\Backup Exec\RAWS\beremote.exe
• C:\Program Files\Symantec\Backup Exec\RAWS\beremote.exe
• ParentImage=*\beremote.exe NewProcessName=*\cmd.exe
• ParentImage=*\beremote.exe NewProcessName=*\powershell.exe
• ParentImage=*\beremote.exe NewProcessName=*\pwsh.exe
• ParentImage=*\beremote.exe NewProcessName=*\wmic.exe
• ParentImage=*\beremote.exe NewProcessName=*\rundll32.exe
• ParentImage=*\beremote.exe NewProcessName=*\regsvr32.exe
• ParentImage=*\beremote.exe NewProcessName=*\certutil.exe
• ParentImage=*\beremote.exe NewProcessName=*\bitsadmin.exe
• ParentImage=*\beremote.exe NewProcessName=*\net.exe
• ParentImage=*\beremote.exe NewProcessName=*\net1.exe
• ParentImage=*\beremote.exe NewProcessName=*\nltest.exe
• ParentImage=*\beremote.exe NewProcessName=*\whoami.exe
• ParentImage=*\beremote.exe NewProcessName=*\ipconfig.exe
• ParentImage=*\beremote.exe NewProcessName=*\vssadmin.exe
• ParentImage=*\beremote.exe NewProcessName=*\wbadmin.exe
• ParentImage=*\beremote.exe NewProcessName=*\bcdedit.exe
• vssadmin.exe Delete Shadows
• wbadmin.exe delete catalog
• bcdedit.exe /set {default} recoveryenabled No
• sc.exe create
• schtasks.exe /create

What your security team should do

• Immediately inventory all Veritas Backup Exec servers and agents and identify versions earlier than 21.2.
• Patch or upgrade affected systems to Backup Exec 21.2 or later, preferably the latest supported release.
• Treat exposed or unpatched systems as urgent because the vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware campaigns.
• Block Internet and untrusted-network access to Backup Exec agent services; allow connections only from authorized Backup Exec infrastructure.
• Hunt for suspicious child processes spawned by Backup Exec agent processes, especially cmd.exe, powershell.exe, wmic.exe, rundll32.exe, regsvr32.exe, certutil.exe, net.exe, nltest.exe, vssadmin.exe, wbadmin.exe, bcdedit.exe, and ransomware tooling.
• Review backup integrity, recent deletion or modification activity, failed backup jobs, and unexpected restore/export activity.
• Rotate Backup Exec service-account credentials and other credentials accessible to backup systems if exploitation is suspected.
• Ensure backups are protected using offline, immutable, or logically isolated storage to reduce ransomware impact.
• Increase monitoring around Backup Exec servers and agents, including process creation, service creation, authentication events, and inbound network connections to Backup Exec ports.
• If compromise indicators are found, isolate affected backup hosts before attackers can delete backups or use them for lateral movement.