What’s Vulnerable › Vulnerabilities

CVE-2017-8895

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 71.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-05-10 · updated 2026-06-17
• Weakness: CWE-416

Description

In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.

Affected products

• Veritas Backup Exec: before 14.1.1786.1126; before 14.2.1180.3160; before 16.0.1142.1327 — fixed in 14.1.1786.1126, 14.2.1180.3160, 16.0.1142.1327

How to fix

Upgrade to a fixed version: Veritas Backup Exec 14.1.1786.1126, 14.2.1180.3160, 16.0.1142.1327. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/98386
• http://www.securitytracker.com/id/1038561
• https://www.exploit-db.com/exploits/42282/
• https://www.veritas.com/content/support/en_US/security/VTS17-006.html#Issue1
• http://www.securityfocus.com/bid/98386
• http://www.securitytracker.com/id/1038561
• https://www.exploit-db.com/exploits/42282/
• https://www.veritas.com/content/support/en_US/security/VTS17-006.html#Issue1

Get alerted when CVE-2017-8895 or the next vulnerability affects your stack