Exploited vulnerability · CISA KEV

Is CVE-2021-27876 exploited? Yes: in CISA KEV since 7 Apr 2023

Gociux · Veritas Backup Exec Agent · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-27876, Veritas Backup Exec Agent File Access Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 7 Apr 2023, 767 days after it was published. It is known to be used in ransomware campaigns. It affects Veritas Backup Exec Agent. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.

What to do

1. Check whether you run it. Look for Backup Exec Agent in your asset inventory, including appliances and cloud images. Stack check lists every exploited Veritas CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 1 Mar 2021.
4. Get told next time. Email alerts when CISA adds a CVE for Veritas.

Other exploited CVEs in Backup Exec Agent

• CVE-2021-27877: Veritas Backup Exec Agent Improper Authentication Vulnerability (7 Apr 2023)
• CVE-2021-27878: Veritas Backup Exec Agent Command Execution Vulnerability (7 Apr 2023)

References

• www.veritas.com/support/en_US/security/VTS21-001
• nvd.nist.gov/vuln/detail/CVE-2021-27876

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in April 2023 · Veritas scorecard · act-now radar.