Exploited vulnerability · CISA KEV

Is CVE-2021-27877 exploited? Yes: in CISA KEV since 7 Apr 2023

Gociux · Veritas Backup Exec Agent · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2021-27877, Veritas Backup Exec Agent Improper Authentication Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 7 Apr 2023, 767 days after it was published. It is known to be used in ransomware campaigns. It affects Veritas Backup Exec Agent. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.

What to do

1. Check whether you run it. Look for Backup Exec Agent in your asset inventory, including appliances and cloud images. Stack check lists every exploited Veritas CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 1 Mar 2021.
4. Get told next time. Email alerts when CISA adds a CVE for Veritas.

Other exploited CVEs in Backup Exec Agent

• CVE-2021-27876: Veritas Backup Exec Agent File Access Vulnerability (7 Apr 2023)
• CVE-2021-27878: Veritas Backup Exec Agent Command Execution Vulnerability (7 Apr 2023)

References

• www.veritas.com/support/en_US/security/VTS21-001
• nvd.nist.gov/vuln/detail/CVE-2021-27877

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in April 2023 · Veritas scorecard · act-now radar.