TI-2021-09222 Aliases CVE-2021-27877 GHSA-grhg-3w4v-cp2r

An issue was discovered in Veritas Backup Exec before 21.2.

CRITICAL 99Exploited in the wildPublished 2021-03-01 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

Why it matters now

Exploitation Active In CISA KEV since 2023-04-07CISA due date 2023-04-28Known ransomware use

EPSS 0.6491 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:veritas:backup_exec::::::::	before 21.2	Vulnerable	Veritas

cpe:2.3:a:veritas:backup_exec:*:*:*:*:*:*:*:* Versions before 21.2 Vulnerable ·Veritas

Remediation

No fixed version listed by the sources yet.

Timeline

2023-04-07 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2021-27877
2026-10-03 Alias added: GHSA-grhg-3w4v-cp2r

References

Exploit 1

http://packetstormsecurity.com/files/168506/Veritas-Backup-Exec-Agent-Remote-Code-Execution.html

Advisory 1

https://www.veritas.com/content/support/en_US/security/VTS21-001#issue1

TI-2021-09223 An issue was discovered in Veritas Backup Exec before 21.2. KEVCVSS 3.1HIGH 8.8
TI-2021-09221 An issue was discovered in Veritas Backup Exec before 21.2. KEVCVSS 3.1HIGH 8.1
TI-2017-06392 In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160… CVSS 3.0CRITICAL 9.8
TI-2005-00716 VERITAS Backup Exec 9.0 through 10.0 for Windows Servers, and 9.0.4019 through 9.1.307… CVSS 3.1HIGH 7.5
TI-2020-18487 An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before… CVSS 3.1CRITICAL 9.3
TI-2024-22257 An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. CVSS 3.1HIGH 7.8

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences