CVE-2021-27878 is a command execution vulnerability in Veritas Backup Exec Agent. CISA added it to the Known Exploited Vulnerabilities catalogue on 7 April 2023, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What This Vulnerability Means in a Backup Agent
Command execution in a backup agent is especially dangerous because backup software often runs with elevated permissions and broad network reach. If an attacker can execute commands through the agent, they may be able to move from a single vulnerable host to wider backup infrastructure, storage targets, or other systems the agent can access.
That makes this class of flaw more than a local application bug. A successful exploit can turn a backup product into an execution foothold, which is why priority should be given to vendor remediation and, where necessary, temporary containment around the exposed agent.
Why It Becomes High-Impact in Practice
Backup tools are trusted operational systems, so compromise can affect recovery confidence as well as day-to-day security. An attacker who reaches command execution may use the same trust relationship that the product relies on for normal administration, which can expand the blast radius beyond the initial endpoint.
This is also why vulnerability tracking matters. For coordinated exposure checks, use the vendor advisory and the NIST National Vulnerability Database alongside the CVE Program record to confirm the issue identity, then map that record to the software actually deployed in your environment.
How Organisations Check Exposure and Contain It
The first question is whether the affected Backup Exec Agent exists anywhere in the estate, including forgotten servers, DR systems and backup jump hosts. From there, teams should verify whether the product is reachable in ways that make exploitation more likely, especially where management interfaces or agent communications are exposed beyond intended trust boundaries.
When patching cannot happen immediately, compensating controls should narrow who can reach the agent, reduce administrative exposure, and separate backup traffic from general user access. For a practical prioritisation approach, NHIMG’s Vulnerability Management Guide is useful for aligning asset scope, KEV status and remediation urgency.
Detection, Recovery, and Identity Impact
Command execution should be treated as a potential compromise of the host, not just a vulnerability event. Look for unexpected process creation, unusual child processes spawned by the backup service, changes to scheduled tasks or services, and signs that the attacker used the host to reach adjacent systems or backup repositories.
If exploitation is confirmed or strongly suspected, review what the agent could access and rotate any credentials, keys or service accounts that may have been exposed through that path. For response planning, NHIMG’s State of NHI & AI Agent Breach Report is a useful reminder that credential theft and lateral movement often follow initial trust abuse, even when the original entry point looks narrow.
Risk and Threat Considerations
Backup software is a high-value target because it often sits close to privileged data, broad restore rights and critical infrastructure. A command execution flaw can therefore create both availability risk, through disruption of backup operations, and security risk, through misuse of the backup platform as an internal pivot point.
Failure mechanism: An attacker exploits the vulnerable agent to execute commands with the product’s effective privileges, then abuses that foothold to enumerate systems, tamper with backup jobs, or stage follow-on access.
Impact: Compromise may extend beyond the initial host to backup integrity, recovery readiness, and other systems reachable by the agent, increasing the chance of outage, data loss, or broader intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires urgent identification and remediation of exposed vulnerable assets. |
| Recommendation — Prioritise, patch, and verify the affected backup agent under your vulnerability management process. | ||
| NIST CSF 2.0 | PR.IP-12 — Vulnerability management | The term is about a known exploited vulnerability that needs disciplined remediation and tracking. |
| Recommendation — Track the vulnerable agent, remediate it quickly, and confirm closure in your vulnerability register. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Exploitability in a product demands controlled flaw remediation and timely mitigation. |
| Recommendation — Apply flaw remediation procedures and confirm the vulnerable agent is updated or contained. | ||
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | The vulnerability enables attacker command execution on the target host. |
| Recommendation — Map post-exploitation activity to command execution tradecraft and hunt for spawned processes. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Command execution vulnerabilities reflect architectural and code-path failures that break trust boundaries. |
| Recommendation — Review the affected execution path and harden server-side command handling patterns. | ||
Practitioner Guidance
Why practitioners should care: A backup agent is not a low-value utility when it can reach protected assets, so treat exploitable command execution as a priority security event rather than a routine patch item.
What to watch for: Focus on evidence that the agent has been used as an execution path, including abnormal service behaviour, unexpected binaries, and changes to backup or recovery configuration that do not match normal administration.
Practitioner takeaway: The right response is to verify exposure, contain the reachable agent paths, remediate with the vendor fix as soon as possible, and then validate that backup trust was not already abused.
Related resources from NHI Mgmt Group
- What breaks when agent permissions rely on command patterns instead of execution semantics?
- CVE-2021-1647 (Microsoft Defender Remote Code Execution)
- What breaks when sandbox validation does not match actual execution in agent systems?
- What breaks when an AI agent is compromised during active execution?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org