TI-2021-09221 Aliases CVE-2021-27876 GHSA-9j5v-h34p-h6g6

An issue was discovered in Veritas Backup Exec before 21.2.

CRITICAL 94Exploited in the wildPublished 2021-03-01 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.

Why it matters now

Exploitation Active In CISA KEV since 2023-04-07CISA due date 2023-04-28Known ransomware use

EPSS 0.13518 96th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:veritas:backup_exec::::::::	before 21.2	Vulnerable	Veritas

cpe:2.3:a:veritas:backup_exec:*:*:*:*:*:*:*:* Versions before 21.2 Vulnerable ·Veritas

Remediation

No fixed version listed by the sources yet.

Timeline

2023-04-07 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2021-27876
2026-10-03 Alias added: GHSA-9j5v-h34p-h6g6

References

Exploit 1

http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html

Advisory 1

https://www.veritas.com/content/support/en_US/security/VTS21-001#issue2

TI-2021-09222 An issue was discovered in Veritas Backup Exec before 21.2. KEVCVSS 3.1CRITICAL 9.8
TI-2021-09223 An issue was discovered in Veritas Backup Exec before 21.2. KEVCVSS 3.1HIGH 8.8
TI-2017-06392 In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160… CVSS 3.0CRITICAL 9.8
TI-2005-00716 VERITAS Backup Exec 9.0 through 10.0 for Windows Servers, and 9.0.4019 through 9.1.307… CVSS 3.1HIGH 7.5
TI-2020-18487 An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before… CVSS 3.1CRITICAL 9.3
TI-2024-22257 An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. CVSS 3.1HIGH 7.8

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences