Is CVE-2021-27877 (Veritas Backup Exec Agent Improper Authentication) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 18, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-27877 to its Known Exploited Vulnerabilities catalogue on 7 April 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.

What “being exploited in the wild” means for this CVE

This question is really about confidence, not just vulnerability existence. For CVE-2021-27877, the practical signal is that it crossed from theoretical weakness into confirmed active abuse, which changes how quickly you should treat exposure, verification and containment. Once a flaw is in KEV and tied to ransomware activity, it should be handled as an urgent incident-response and exposure-management problem, not a normal patch queue item.

For a vulnerable BE Agent deployment, the key decision is whether the affected component is reachable, deployed in a sensitive environment, or exposed through a management path that attackers can abuse. If it is present, the operational question is no longer whether exploitation is possible in general, but whether your environment has already been reachable long enough to be targeted.

How to confirm exposure and reduce the attack window

The first practical step is to verify whether Veritas Backup Exec Agent is installed anywhere in scope, including servers that may have been forgotten after migration or backup consolidation. Systems that handle backup operations are especially important because compromise there can affect restore confidence as well as data availability.

If the product is present, treat the vendor advisory and the CISA KEV catalog as the authoritative sources for version and remediation details, and use them to drive your remediation plan. Where patching is delayed, focus on restricting network reachability, limiting who can contact the agent, and validating that only intended administrative paths remain open.

Because the direct issue is improper authentication, any exposed management or service interface deserves immediate review for weak access paths, unexpected accounts, or legacy trust assumptions. A vulnerable backup agent is not just another endpoint service, it can become a pivot point into systems that hold sensitive data, credentials, or recovery tooling.

What to do if exploitation may already have happened

When a vulnerability is known exploited, the response should include compromise checks, not only patching. Review authentication logs, service activity, backup job changes, unusual administrative actions and any signs that the agent was accessed in ways that do not match normal backup operations.

If there is any credible evidence that the affected host or backup workflow was accessed, assess whether related credentials, sessions, service accounts or backup credentials should be rotated. That is especially important where the agent had access to backup repositories, domain-connected systems or other infrastructure that could magnify downstream impact.

Restore points should also be treated carefully. A backup platform can preserve recovery, but it can also preserve attacker access if malicious changes or stolen material were captured before detection.

Risk and Threat Considerations

Exploited backup infrastructure is high-value to attackers because it can support ransomware preparation, defense evasion and recovery disruption. Improper authentication raises the risk that an attacker can reach a management plane, discover backup assets, and use that foothold to weaken recovery options or move toward more sensitive systems.

Failure mechanism: The vulnerable agent accepts unauthorized access through its SHA authentication scheme, so an attacker who can reach the service may bypass intended trust boundaries and interact with backup functions or adjacent systems.

Impact: Successful abuse can expose backup data, undermine recovery integrity, and provide a route into broader ransomware activity, especially if the same environment also stores credentials or privileged administrative paths.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	CVE-2021-27877 is an authentication weakness, so credential and authenticator lifecycle control is material.
	SI-2 — Flaw Remediation	The question hinges on urgent remediation of a known exploited vulnerability in a deployed product.
Recommendation — Rotate or revoke any authenticator material that could have been used through the affected agent. Prioritise and track remediation for the affected Backup Exec Agent as an urgent flaw-removal item.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed active exploitation requires rapid identification and prioritisation of exposed instances.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	Limiting exposure while patching depends on reducing reachable attack surface around the agent.
Recommendation — Inventory the agent, prioritise affected assets, and remediate according to exploitation risk. Restrict access paths and harden the agent configuration until remediation is complete.
MITRE ATT&CK	T1210 — Exploitation of Remote Services	Active exploitation of a remotely reachable management service is the core attacker pattern implied here.
Recommendation — Hunt for exploitation of the exposed service and correlate it with abnormal backup activity.

Practitioner Guidance

What to verify: Confirm every deployment location, not just the primary backup server. For each instance, verify exposure, patch status, reachable ports and whether the agent is reachable from networks that should never need backup administration access.

Decision rule: If the agent is internet-facing or broadly reachable internally, treat it as an urgent containment case and accelerate remediation before broader hygiene work. If patching must wait, narrow access first, then validate logs and change history for signs of prior use.

Practitioner takeaway: For a KEV-listed vulnerability tied to ransomware, the right question is not whether the flaw is “serious enough,” but whether you have already closed the exposure path and ruled out prior misuse.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org