Loading vulnerability…
CVE-2021-27876 is a vulnerability in Veritas Backup Exec (versions 16.x, 20.x, and 21.1) where a flaw in the SHA authentication scheme allows an attacker to gain unauthorized access to the Backup Exec Agent. Once authenticated, the attacker can execute data management protocol commands, including those that allow access to arbitrary files on the system with SYSTEM privileges. The vulnerability is present in all agents on all platforms running the affected versions.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single customized Metasploit exploit module plus a README. It is clearly an exploit, not just documentation or detection logic. The code is a modified version of Rapid7’s Veritas Backup Exec Agent RCE module that targets the legacy SHA authentication weakness in the Backup Exec Agent / Remote Agent service exposed over TCP/10000. The module belongs to the Metasploit framework, so the main relevant file is `beagent_sha_auth_rce_custom.rb`. The exploit flow is network-based: it connects to the Backup Exec Agent, negotiates/enables TLS, performs SHA-based authentication, and then invokes the NDMP execute-command functionality to run an arbitrary OS command. The customization removes payload upload/staging behavior and instead adds a `COMMAND` option for direct one-shot command execution. On Windows it wraps the operator command with `C:\Windows\System32\cmd.exe /c`, and on Linux it wraps it with the configured shell (default `/bin/bash -c`). The README explicitly notes that this variant does not create a Meterpreter session and does not automatically return stdout/stderr; operators must embed their own callback or exfiltration mechanism in the command, such as a PowerShell `Invoke-WebRequest` POST to an HTTP listener. Repository structure is minimal: `README.md` explains installation into a local Metasploit tree, usage, and an example callback pattern; `beagent_sha_auth_rce_custom.rb` contains the exploit logic and NDMP/XDR request/response structures. The module metadata indicates affected versions across Backup Exec 16.x, 20.x, and 21.x up to 21.2, plus Backup Exec Remote Agent revision 9.3 and earlier, and claims code execution as SYSTEM on Windows or root on Linux. Overall, this is an operational Metasploit-based RCE module customized for reliable command execution validation rather than session establishment.
Repository is a small standalone Python proof-of-concept/operational exploit consisting of one main script (be_rce.py), a README, and a license. The script targets Veritas Backup Exec Agent over the network on TCP/10000 using NDMP and implements a full exploit chain for CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878. The exploit is not merely a detector: it performs active exploitation. Its core capabilities are: connecting to the NDMP service, performing the custom TLS-related handshake by generating a local CA and signing the agent CSR, abusing the SHA authentication weakness to authenticate as Administrator without a password, invoking NDMP_EXECUTE_COMMAND to run arbitrary OS commands as NT AUTHORITY\SYSTEM, reading command output back from a temporary file via NDMP file operations, and deleting the temporary file afterward. Code structure in be_rce.py includes: XDR serialization/deserialization helpers for NDMP message formatting; an NDMPSock class for framed NDMP send/receive and TLS socket wrapping; certificate helper routines to generate a CA and sign the server CSR; and an exploit entry point that chains connection, handshake, auth bypass, command execution, file open/read/close, and cleanup. The script accepts target and command from the command line, with a hardcoded default target IP if omitted. Notable observables include the NDMP service port 10000, the Windows temp output file C:\Windows\Temp\_be_out.txt, and use of C:\Windows\System32\cmd.exe for execution. The README documents affected versions, usage examples, and remediation guidance. Overall, this is a real standalone network RCE exploit with a basic but functional hardcoded payload flow, making it best classified as OPERATIONAL rather than a framework-integrated or detection-only artifact.
This repository contains a single Metasploit module (beagent_sha_auth_rce.rb) that exploits a remote code execution vulnerability in Veritas Backup Exec Agent (CVE-2021-27876, CVE-2021-27877, CVE-2021-27878). The exploit targets the NDMP service (default TCP port 10000) and abuses the legacy SHA authentication scheme to gain unauthorized access. Upon successful exploitation, it allows the attacker to execute arbitrary commands or upload and run a payload as SYSTEM (Windows) or root (Linux). The module supports both Windows and Linux targets, using appropriate payload stagers for each platform. The code is weaponized, leveraging Metasploit's framework for payload delivery and session management. The only fingerprintable network endpoint is the NDMP service on TCP port 10000. The repository is structured as a single Ruby file compatible with Metasploit, and is intended for use within the framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.