Yes. CISA added CVE-2021-27878 to its Known Exploited Vulnerabilities catalogue on 7 April 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
What being in CISA KEV means for CVE-2021-27878
CISA’s KEV catalogue is the practical signal that matters most here. For this Veritas Backup exec agent command execution flaw, the question is not whether exploitation is theoretically possible, but whether there is reliable evidence that attackers are already using it and whether defenders should treat exposure as urgent.
Once a vulnerability is listed in KEV, organisations should assume the issue is exploitable in live environments until proven otherwise. For a remotely reachable agent or management component, that usually means the attack surface is worth validating immediately, even if no incident has yet been observed on your own systems.
CISA Known Exploited Vulnerabilities Catalog is the authoritative place to confirm the listing and any required remediation expectations.
How to confirm exposure without waiting for compromise
Start by identifying where Veritas Backup Exec Agent is deployed, which hosts expose it, and whether the vulnerable command path is reachable from networks you do not fully trust. If the product sits on backup infrastructure, treat that environment as high value because it often has broad visibility into servers, file systems, and credentials.
Verification is about more than software inventory. You should also confirm who can reach the agent, whether segmentation is actually enforced, and whether the host has any unusual outbound activity, new child processes, or unexpected administrative actions. Those checks help separate mere presence of the software from realistic exploitability.
NIST National Vulnerability Database and CVE Program are useful when you need the canonical record for the vulnerability and its identifiers before you move to local validation.
Why command execution on a backup agent is operationally serious
A command execution flaw in a backup agent is often more serious than the same bug in a low-value utility because backup systems tend to run with elevated reach and broad data access. If an attacker can execute commands on the agent machine, they may be able to pivot into backup repositories, tamper with restore data, or use the host as a foothold for broader lateral movement.
That is why exploitability in backup tooling frequently becomes a business continuity issue, not just a vulnerability management item. If ransomware operators can reach the backup tier, they may target recovery paths, credentials, and backup trust relationships alongside the original host compromise.
Vulnerability Management Guide is the right internal reference when you are deciding how to prioritise an exploited vulnerability, when to escalate, and how to verify remediation.
Risk and Threat Considerations
Exploited backup-agent vulnerabilities are especially dangerous because they combine confirmed attacker interest with a high-value operational role. If the agent has privileged reach, a successful command execution can quickly become data exposure, backup tampering, or ransomware staging.
Failure mechanism: An attacker sends or relays a crafted data management protocol command that the agent processes as executable action, then uses the resulting code execution to enumerate the host, access backup data, or move into adjacent systems.
Impact: Organisations can lose confidentiality, integrity, and recovery confidence at the same time, which makes restoration slower and incident containment harder even when production systems are still running.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation requires rapid prioritisation and verification of exposed systems. |
| Recommendation — Prioritise and verify remediation of the exploited Backup Exec Agent flaw on any exposed asset. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | Exploited CVEs demand exposure confirmation, validation, and tracked remediation. |
| SI-2 — Flaw Remediation | A KEV-listed flaw needs prompt remediation and compensating controls when patching lags. | |
| AU-6 — Audit Review, Analysis, and Reporting | Post-exploitation checks rely on log review and anomaly analysis around the affected host. | |
| Recommendation — Scan for the vulnerable agent, validate exposure, and track remediation to closure. Apply the fix or compensating controls for the Backup Exec Agent command execution flaw. Review logs for suspicious command execution, backup job changes, and unusual host activity. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | KEV-listed exploitation is a vulnerability-management case requiring prioritised treatment. |
| Recommendation — Triage the Backup Exec Agent flaw as an actively exploited vulnerability and document remediation. | ||
Practitioner Guidance
What to prioritise: Treat any externally reachable Backup Exec Agent instance as a time-sensitive exposure, and prioritise hosts that also store backup credentials, repositories, or restore metadata. If patching is delayed, reduce reachability first.
What to verify: Confirm whether the vulnerable agent is actually exposed, whether any suspicious command activity occurred before remediation, and whether backup jobs, service accounts, or scheduled tasks were altered. If you find unexplained process creation or authentication anomalies on the host, expand the hunt beyond the product itself.
Practitioner takeaway: For KEV-listed command execution flaws in backup infrastructure, the key question is not only “is it patched?” but “can this host still be used to reach recovery assets or stage ransomware?”
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- CVE-2021-27878 (Veritas Backup Exec Agent Command Execution)
- CVE-2021-27876 (Veritas Backup Exec Agent File Access)
- CVE-2021-27877 (Veritas Backup Exec Agent Improper Authentication)
- Is CVE-2021-1647 (Microsoft Defender Remote Code Execution) being exploited in the wild?