The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to patch three (3) critical vulnerabilities impacting internet-facing Windows servers running Veritas Backup Exec Installations. Veritas is a data backup and recovery suite that has approximately 8,500 installations according to internet scans. These flaws are being exploited by new ALPHV (aka BlackCat) affiliates tracked as UNC4466 in order to drop the rust-based ransomware. The first vulnerability is tracked as CVE-2021-27876 and is a file access vulnerability that can be exploited via malicious input parameters to take control of a target system. The second flaw, tracked as CVE-2021-27877, is an improper authentication vulnerability that could be exploited by an unauthenticated attacker to authenticate within the system through a SHA authentication scheme. The third flaw, tracked as CVE-2021-27878, is a command execution vulnerability which could allow an attacker to exploit a data management protocol to execute arbitrary code. The UNC4466 attacks were initiated with the Metasploit module “exploit/multi/veritas/beagent_sha_auth_rce”, targeting servers running Veritas Backup Exec, and maintaining persistence within the network through Metasploit modules as well. These vulnerabilities impact any instances of Veritas Backup Exec running versions prior to 21.2. CTIX analysts recommend that any organizations running these versions patch their software, as well as conduct manual mitigation techniques like enabling multi-factor authentication (MFA), implementing secure access controls, and segmenting impacted networks. Technical details and indicators of compromise (IOCs) can be found in the report linked below.