119
CVEs
40
Critical
47
High
4
KEV
6
PoC
68
Unpatched C/H
27.7%
Patch Rate
3.3%
Avg EPSS
Severity Breakdown
CRITICAL
40
HIGH
47
MEDIUM
32
LOW
0
Monthly CVE Trend
Affected Products (30)
Netbackup
59
Netbackup Appliance
41
Flex Appliance
19
Flex Scale
17
Enterprise Vault
16
Backup Exec
6
Aptare
6
Netbackup Flex Scale Appliance
6
Infoscale Operations Manager
5
Access Appliance
5
Access
4
Resiliency Platform
4
Java
3
System Recovery
3
Netbackup Appliance Firmware
2
Communications Policy Management
1
Financial Services Enterprise Case Management
1
Retail Integration Bus
1
Communications Cloud Native Core Policy
1
Financial Services Analytical Applications Infrastructure
1
Retail Bulk Data Integration
1
Communications Cloud Native Core Binding Support Function
1
Communications Cloud Native Core Automated Test Suite
1
Cx Cloud Agent
1
Retail Customer Management And Segmentation Foundation
1
Communications Cloud Native Core Network Exposure Function
1
Tomcat
1
Financial Services Behavior Detection Platform
1
Cluster Server
1
Siveillance Identity
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2021-27877 | An issue was discovered in Veritas Backup Exec before 21.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 64.9% | 199 |
KEV
PoC
No patch
|
| CVE-2017-8895 | In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 67.1%. | CRITICAL | 9.8 | 67.1% | 151 |
PoC
|
| CVE-2022-22965 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 99.7% | 84 |
KEV
PoC
|
| CVE-2021-27878 | An issue was discovered in Veritas Backup Exec before 21.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 24.0% | 79 |
KEV
PoC
No patch
|
| CVE-2021-27876 | An issue was discovered in Veritas Backup Exec before 21.2. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 13.4% | 76 |
KEV
PoC
No patch
|
| CVE-2016-7399 | scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to execute arbitrary commands via shell. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 13.4%. | CRITICAL | 9.8 | 13.4% | 62 |
|
| CVE-2017-8857 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 3.8% | 53 |
No patch
|
| CVE-2015-6550 | bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 3.0% | 52 |
No patch
|
| CVE-2017-8856 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution using the 'bprd' process. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.4% | 51 |
No patch
|
| CVE-2015-6552 | The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.2% | 51 |
No patch
|
| CVE-2023-26788 | Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.4% | 50 |
PoC
No patch
|
| CVE-2017-8858 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.4% | 50 |
No patch
|
| CVE-2017-8859 | In Veritas NetBackup Appliance 3.0 and earlier, unauthenticated users can execute arbitrary commands as root. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.1% | 50 |
No patch
|
| CVE-2017-6403 | An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.6% | 50 |
No patch
|
| CVE-2017-6409 | An issue was discovered in Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.5% | 50 |
No patch
|