Loading vulnerability…
CVE-2021-27877 is an arbitrary command execution vulnerability in Veritas Backup Exec before version 21.2. The issue stems from continued support for a legacy SHA-based authentication scheme that was no longer used by current product versions but had not been disabled. A remote attacker can exploit this obsolete authentication path to bypass intended access controls, gain unauthorized access to a Backup Exec Agent, and execute privileged commands on the target system.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
5 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This one-file Ruby Metasploit remote exploit module targets the Veritas Backup Exec Agent legacy SHA authentication implementation associated with CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878. It connects to the agent's NDMP service on a configurable target host, default TCP/10000, enables TLS, performs the obsolete SHA authentication flow, and abuses the NDMP_EXECUTE_COMMAND primitive to execute operating-system commands without legitimate agent credentials. The module defines XDR request/response structures for NDMP connection, TLS handshake, SHA authentication challenge/response, command execution, and file operations. Windows targets receive commands wrapped with cmd.exe and execute with SYSTEM privileges; the default action creates a local administrator account, while CMD permits arbitrary command execution. Linux targets execute through a configurable shell (default /bin/bash) and use Metasploit CmdStager support for payload delivery. It is an operational framework module with configurable commands and staged payload support, though its notes identify disk artifacts and log indicators and an unreliable-session reliability rating.
The repository contains one Ruby Metasploit remote-exploit module, beagent_sha_auth_rce.rb. It targets the legacy SHA authentication path in Veritas Backup Exec Agent/Remote Agent, associated with CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878. The module connects to the configurable RHOSTS target on TCP port 10000 by default, performs an NDMP connection and TLS-enabling exchange, authenticates using the obsolete SHA scheme, then sends an NDMP_EXECUTE_COMMAND request. It supports Windows x86/x64 and Linux x86/x64 targets. Windows execution is wrapped by cmd.exe and runs as SYSTEM; its default behavior is to create an administrator account, while CMD permits arbitrary command execution. Linux execution is wrapped in the configured shell and can use Metasploit CmdStager flavors to deliver and execute payloads. The module also defines XDR structures for the NDMP protocol, including connect, authentication, command execution, and file-operation request/response packets. It is an operational Metasploit module rather than a detection-only script; its declared side effects include possible on-disk artifacts and target logging indicators.
This repository contains a single customized Metasploit exploit module plus a README. It is clearly an exploit, not just documentation or detection logic. The code is a modified version of Rapid7’s Veritas Backup Exec Agent RCE module that targets the legacy SHA authentication weakness in the Backup Exec Agent / Remote Agent service exposed over TCP/10000. The module belongs to the Metasploit framework, so the main relevant file is `beagent_sha_auth_rce_custom.rb`. The exploit flow is network-based: it connects to the Backup Exec Agent, negotiates/enables TLS, performs SHA-based authentication, and then invokes the NDMP execute-command functionality to run an arbitrary OS command. The customization removes payload upload/staging behavior and instead adds a `COMMAND` option for direct one-shot command execution. On Windows it wraps the operator command with `C:\Windows\System32\cmd.exe /c`, and on Linux it wraps it with the configured shell (default `/bin/bash -c`). The README explicitly notes that this variant does not create a Meterpreter session and does not automatically return stdout/stderr; operators must embed their own callback or exfiltration mechanism in the command, such as a PowerShell `Invoke-WebRequest` POST to an HTTP listener. Repository structure is minimal: `README.md` explains installation into a local Metasploit tree, usage, and an example callback pattern; `beagent_sha_auth_rce_custom.rb` contains the exploit logic and NDMP/XDR request/response structures. The module metadata indicates affected versions across Backup Exec 16.x, 20.x, and 21.x up to 21.2, plus Backup Exec Remote Agent revision 9.3 and earlier, and claims code execution as SYSTEM on Windows or root on Linux. Overall, this is an operational Metasploit-based RCE module customized for reliable command execution validation rather than session establishment.
Repository is a small standalone Python proof-of-concept/operational exploit consisting of one main script (be_rce.py), a README, and a license. The script targets Veritas Backup Exec Agent over the network on TCP/10000 using NDMP and implements a full exploit chain for CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878. The exploit is not merely a detector: it performs active exploitation. Its core capabilities are: connecting to the NDMP service, performing the custom TLS-related handshake by generating a local CA and signing the agent CSR, abusing the SHA authentication weakness to authenticate as Administrator without a password, invoking NDMP_EXECUTE_COMMAND to run arbitrary OS commands as NT AUTHORITY\SYSTEM, reading command output back from a temporary file via NDMP file operations, and deleting the temporary file afterward. Code structure in be_rce.py includes: XDR serialization/deserialization helpers for NDMP message formatting; an NDMPSock class for framed NDMP send/receive and TLS socket wrapping; certificate helper routines to generate a CA and sign the server CSR; and an exploit entry point that chains connection, handshake, auth bypass, command execution, file open/read/close, and cleanup. The script accepts target and command from the command line, with a hardcoded default target IP if omitted. Notable observables include the NDMP service port 10000, the Windows temp output file C:\Windows\Temp\_be_out.txt, and use of C:\Windows\System32\cmd.exe for execution. The README documents affected versions, usage examples, and remediation guidance. Overall, this is a real standalone network RCE exploit with a basic but functional hardcoded payload flow, making it best classified as OPERATIONAL rather than a framework-integrated or detection-only artifact.
This repository contains a single Metasploit module (beagent_sha_auth_rce.rb) that exploits a remote code execution vulnerability in Veritas Backup Exec Agent (CVE-2021-27876, CVE-2021-27877, CVE-2021-27878). The exploit targets the NDMP service (default TCP port 10000) and abuses the legacy SHA authentication scheme to gain unauthorized access. Upon successful exploitation, it allows the attacker to execute arbitrary commands or upload and run a payload as SYSTEM (Windows) or root (Linux). The module supports both Windows and Linux targets, using appropriate payload stagers for each platform. The code is weaponized, leveraging Metasploit's framework for payload delivery and session management. The only fingerprintable network endpoint is the NDMP service on TCP port 10000. The repository is structured as a single Ruby file compatible with Metasploit, and is intended for use within the framework.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The content references CVE-2021-27877 only as a filename or repository item being moved; no technical details about the vulnerability itself are provided.
An arbitrary command execution vulnerability in Veritas Backup Exec, listed as exploited by ALPHV affiliates/operators.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.