CVE-2021-27878

Veritas Backup Exec Agent allows remote command execution via data management protocol commands, enabling ransomware attackers to compromise backup systems.

An attacker can execute arbitrary commands on the Veritas Backup Exec Agent machine using a data management protocol command, directly enabling ransomware deployment. DIB organizations must patch this unpatched, actively exploited vulnerability immediately to prevent backup system compromise and data loss. This is a critical, unpatched RCE that has been exploited in the wild.

Shame score — A critical, actively exploited command execution vulnerability in a backup system that ransomware actors leverage to compromise data and disrupt operations.