Is CVE-2021-27876 (Veritas Backup Exec Agent File Access) being exploited in the wild?

Yes. CISA added CVE-2021-27876 to its Known Exploited Vulnerabilities catalogue on 7 April 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.

What the KEV listing means for this CVE

CISA’s KEV catalogue is the practical signal that this issue has moved from “theoretical vulnerability” to “confirmed exploitation risk.” For Veritas Backup Exec Agent, the key question is not whether the flaw exists, but whether the agent is deployed, reachable, and handling the exposed protocol path that accepts attacker-controlled input.

Because the direct answer already establishes active exploitation and ransomware relevance, the operational priority is exposure confirmation. Treat any internet-facing or broadly reachable Backup Exec Agent installation as higher urgency until you can confirm whether it is present, isolated, and monitored for anomalous file-access attempts.

How teams should assess exposure and likely blast radius

Start with asset inventory, service ownership, and network reachability. If Backup Exec Agent is present anywhere in the estate, determine where the protocol command surface is exposed, what systems it can reach, and whether the agent runs with privileges that could make file access materially sensitive.

For this class of issue, the danger is often broader than the vulnerable component itself. If the agent can read backup catalogs, configuration files, credential stores, or adjacent application data, then attacker access may extend well beyond a single host. That is why file-access flaws in backup tooling are especially serious when backup infrastructure shares trust with production systems.

Use CISA Known Exploited Vulnerabilities Catalog to confirm the current remediation expectation, and compare your deployment state against the vendor advisory rather than relying on generic scanner output alone.

What to do when patching or mitigation must wait

If you cannot remediate immediately, reduce exposure first. Limit network access to the agent to the smallest set of management sources, remove unnecessary routing or remote reachability, and place the service under heightened logging so suspicious command parameters or unusual file reads are easier to spot.

Preserve the evidence you would need if the host was already touched. That includes process execution history, service logs, relevant authentication records, file access logs, and any backup job anomalies around the date you first believe exposure may have occurred. If the agent or its host stores secrets, treat rotation as part of the response plan, not as an optional follow-up.

For broader triage and response sequencing, Zero-Day and Exploited Vulnerabilities Guide is the best fit for deciding whether to patch, isolate, or hunt first when a KEV-listed flaw is already being used in the wild.

Risk and Threat Considerations

This vulnerability matters because backup systems are high-value targets: they often combine broad read access, operational trust, and delayed detection. When an attacker can reach a file-access flaw in a backup agent, the likely outcomes include data exposure, discovery of sensitive configuration material, and a faster path to ransomware preparation or lateral movement.

Failure mechanism: The attacker supplies crafted parameters to the data management protocol command, causing the agent to disclose files it should not expose. If the agent has broad local access, the flaw can become a stepping stone to configuration theft, credential discovery, or backup tampering.

Impact: The immediate impact may be unauthorized file disclosure, but the larger risk is compromise of resilience controls, because backup infrastructure is often what an operator depends on to recover from ransomware or destructive intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Restricts and reviews access paths that expose the vulnerable agent.
	CIS-8 — Audit Log Management	Supports detecting suspicious file-access activity and exploitation attempts.
Recommendation — Limit the agent to approved administrative sources and remove unnecessary access. Log agent activity and preserve records for compromise assessment.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Requires timely remediation of known exploited software flaws.
	AC-4 — Information Flow Enforcement	Supports limiting who can reach the agent and its file-access surface.
Recommendation — Patch or mitigate the vulnerable Backup Exec Agent as soon as feasible. Constrain network and service access to the smallest necessary set of sources.

Practitioner Guidance

What to verify: Confirm whether Backup Exec Agent is deployed, whether it is reachable beyond the management plane, and whether the host contains sensitive configuration or credential material that would increase the value of a successful file read.

Decision rule: If the agent is exposed and you cannot verify rapid remediation, treat the host as an active incident candidate and perform compromise assessment before assuming the issue is only preventive maintenance.

What to prioritise: Prioritise network restriction, patching or vendor mitigation, and log review before broader cleanup work. In backup environments, delaying containment can preserve the attacker’s ability to impair recovery.

Practitioner takeaway: A KEV-listed backup-agent flaw should be handled as a resilience issue as much as a vulnerability issue, because the same trust paths that enable backups can also make recovery unreliable after compromise.