Loading vulnerability…
CVE-2021-27877 is an arbitrary command execution vulnerability in Veritas Backup Exec before version 21.2. The issue stems from continued support for a legacy SHA-based authentication scheme that was no longer used by current product versions but had not been disabled. A remote attacker can exploit this obsolete authentication path to bypass intended access controls, gain unauthorized access to a Backup Exec Agent, and execute privileged commands on the target system.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single customized Metasploit exploit module plus a README. It is clearly an exploit, not just documentation or detection logic. The code is a modified version of Rapid7’s Veritas Backup Exec Agent RCE module that targets the legacy SHA authentication weakness in the Backup Exec Agent / Remote Agent service exposed over TCP/10000. The module belongs to the Metasploit framework, so the main relevant file is `beagent_sha_auth_rce_custom.rb`. The exploit flow is network-based: it connects to the Backup Exec Agent, negotiates/enables TLS, performs SHA-based authentication, and then invokes the NDMP execute-command functionality to run an arbitrary OS command. The customization removes payload upload/staging behavior and instead adds a `COMMAND` option for direct one-shot command execution. On Windows it wraps the operator command with `C:\Windows\System32\cmd.exe /c`, and on Linux it wraps it with the configured shell (default `/bin/bash -c`). The README explicitly notes that this variant does not create a Meterpreter session and does not automatically return stdout/stderr; operators must embed their own callback or exfiltration mechanism in the command, such as a PowerShell `Invoke-WebRequest` POST to an HTTP listener. Repository structure is minimal: `README.md` explains installation into a local Metasploit tree, usage, and an example callback pattern; `beagent_sha_auth_rce_custom.rb` contains the exploit logic and NDMP/XDR request/response structures. The module metadata indicates affected versions across Backup Exec 16.x, 20.x, and 21.x up to 21.2, plus Backup Exec Remote Agent revision 9.3 and earlier, and claims code execution as SYSTEM on Windows or root on Linux. Overall, this is an operational Metasploit-based RCE module customized for reliable command execution validation rather than session establishment.
Repository is a small standalone Python proof-of-concept/operational exploit consisting of one main script (be_rce.py), a README, and a license. The script targets Veritas Backup Exec Agent over the network on TCP/10000 using NDMP and implements a full exploit chain for CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878. The exploit is not merely a detector: it performs active exploitation. Its core capabilities are: connecting to the NDMP service, performing the custom TLS-related handshake by generating a local CA and signing the agent CSR, abusing the SHA authentication weakness to authenticate as Administrator without a password, invoking NDMP_EXECUTE_COMMAND to run arbitrary OS commands as NT AUTHORITY\SYSTEM, reading command output back from a temporary file via NDMP file operations, and deleting the temporary file afterward. Code structure in be_rce.py includes: XDR serialization/deserialization helpers for NDMP message formatting; an NDMPSock class for framed NDMP send/receive and TLS socket wrapping; certificate helper routines to generate a CA and sign the server CSR; and an exploit entry point that chains connection, handshake, auth bypass, command execution, file open/read/close, and cleanup. The script accepts target and command from the command line, with a hardcoded default target IP if omitted. Notable observables include the NDMP service port 10000, the Windows temp output file C:\Windows\Temp\_be_out.txt, and use of C:\Windows\System32\cmd.exe for execution. The README documents affected versions, usage examples, and remediation guidance. Overall, this is a real standalone network RCE exploit with a basic but functional hardcoded payload flow, making it best classified as OPERATIONAL rather than a framework-integrated or detection-only artifact.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The content references CVE-2021-27877 only as a filename or repository item being moved; no technical details about the vulnerability itself are provided.
An arbitrary command execution vulnerability in Veritas Backup Exec, listed as exploited by ALPHV affiliates/operators.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.