{"id":"CVE-2021-27877","published":"2021-03-01T22:15:14Z","modified":"2026-06-17T03:45:32Z","title":"Veritas Backup Exec Agent Improper Authentication Vulnerability","vendor":"Veritas","product":"Backup Exec Agent","tier":"core","eol":null,"description":{"text":"An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.","provenance":"source","from":"NVD"},"summary":{"text":"Veritas Backup Exec Agent contains an improper authentication flaw in a legacy SHA authentication scheme that was no longer used in current versions but had not been disabled. An attacker with remote network access can exploit this scheme without authentication or user interaction to gain unauthorized access to an Agent and execute privileged commands.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:57:59Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.6491,"percentile":0.99245,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-04-07","dueDate":"2023-04-28","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27877","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-04-03","exploitedFirstSeen":"2023-04-03","ransomware":true,"evidence":[{"url":"https://www.mandiant.com/resources/blog/alphv-ransomware-backup","date":"2023-04-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-04-07"},{"url":"https://www.at-bay.com/articles/avoslocker-adds-veritas-vulnerabilities-to-access-arsenal/","date":"2023-06-01"},{"url":"https://blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape","date":"2023-09-14"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-attacks-surge-rely-on-public-legitimate-tools","date":"2024-06-03"},{"url":"https://redalert.nshc.net/2024/07/26/the-activities-summary-of-ransomware-threat-actors-in-2023-kor/","date":"2024-07-26"},{"url":"https://redalert.nshc.net/2024/08/21/summary-of-ransomware-threat-actor-activity-in-2023-eng/","date":"2024-08-21"},{"url":"https://redalert.nshc.net/2024/09/19/summary-of-ransomware-threat-actor-activity-in-2023-jpn/","date":"2024-09-19"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/","date":"2026-03-16"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27877","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote exploitation of exposed authentication scheme","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker could remotely exploit this scheme to gain unauthorized access","start":252,"end":326}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker executes privileged commands on agent","mappingType":"primary_impact","evidence":[{"from":"description","quote":"to gain unauthorized access to an Agent and execute privileged commands","start":299,"end":370}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-14615","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14615","exploited":true,"exploitedSince":"2023-04-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-07-02","earliestUrl":"https://github.com/yashswarup12/CVE-2021-27877-PoC","repos":[{"name":"yashswarup12/CVE-2021-27877-PoC","url":"https://github.com/yashswarup12/CVE-2021-27877-PoC","stars":0,"created":"2026-07-02"}]},"metasploit":[{"name":"Veritas Backup Exec Agent Remote Code Execution","module":"exploit/multi/veritas/beagent_sha_auth_rce","type":"exploit","disclosureDate":"2021-03-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb"}],"nuclei":[{"id":"CVE-2021-27877","name":"Veritas Backup Exec - Broken Authentication","severity":"high","path":"javascript/cves/2021/CVE-2021-27877.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2021/CVE-2021-27877.yaml"}],"first":{"date":"2021-03-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-03-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27877","provenance":"source"},{"date":"2021-03-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2026-07-02","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagent_sha_auth_rce.rb","provenance":"source"},{"date":"2023-04-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.mandiant.com/resources/blog/alphv-ransomware-backup","provenance":"source"},{"date":"2023-04-07","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-04-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14615","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":767},"priority":{"score":79.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1305 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9925"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}