Veritas flaws being used in attacks

CISA lists 3 flaws in Veritas products as being used in attacks, most recently on 7 Apr 2023. All have been used in ransomware.

What to do

1. Update every Veritas product you use.Install the updates Veritas offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksUsed in ransomwareAdded by CISA on 7 Apr 2023
   Veritas Backup Exec Agent
   CVE-2021-27878Veritas Backup Exec Agent Command Execution Vulnerability
   Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
2. Being used in attacksUsed in ransomwareAdded by CISA on 7 Apr 2023
   Veritas Backup Exec Agent
   CVE-2021-27877Veritas Backup Exec Agent Improper Authentication Vulnerability
   Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
3. Being used in attacksUsed in ransomwareAdded by CISA on 7 Apr 2023
   Veritas Backup Exec Agent
   CVE-2021-27876Veritas Backup Exec Agent File Access Vulnerability
   Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Veritas on CISA’s site.