Skip to content
COOEY

FAIL › dossier

Backup Exec Agent

PRODUCT

· dossier confidence 50%

Veritas Backup Exec Agent suffered a catastrophic security failure in 2023, where a cluster of critical, unpatched vulnerabilities in its data management protocol allowed attackers to execute remote code, access local files, and bypass authentication, directly enabling ransomware attacks against backup systems.

Failure events
3
Zero-days
0
RCEs
1
On KEV
3
Critical
3
Worst shame
85
PROFILE
CategoryData Backup & Recovery SoftwareWhat they doVeritas Backup Exec Agent is a data management and backup software component used for protecting enterprise data.
SECURITY POSTURE

The security posture is critically compromised by a cluster of severe, unpatched vulnerabilities in the data management protocol that directly enabled ransomware attacks, unauthorized local file access, and remote code execution.

Notable failures
  • CVE-2021-27877: Unauthorized access via improper SHA authentication
  • CVE-2021-27878: Remote code execution via data management protocol
  • CVE-2021-27876: Local file access via crafted protocol commands
Patterns: critical unpatched protocol-level vulnerabilities enabling ransomware; improper authentication mechanisms allowing unauthorized access
FAILURE HISTORY · 3
DATEEVENTSEVSUMMARY
2023-04-07 CVE-2021-27877 critical Veritas Backup Exec Agent's improper authentication flaw allowed unauthorized access via SHA, enabling ransomware attacks.
2023-04-07 CVE-2021-27878 critical Veritas Backup Exec Agent allows remote command execution via data management protocol commands, enabling ransomware attackers to compromise backup systems.
2023-04-07 CVE-2021-27876 critical Veritas Backup Exec Agent allows attackers to access local files via crafted data management protocol commands.
Open questions: Current patch status of CVE-2021-27877, CVE-2021-27878, and CVE-2021-27876 · Veritas' current security response and remediation timeline for these vulnerabilities
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-27 04:04:28.130815+00:00