Skip to main content

Agent CVE-2025-11790

MEDIUM
Incorrect Permission Assignment for Critical Resource (CWE-732)
2026-03-06 security@acronis.com
4.4
CVSS 3.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
Impact

CVSS 4.4 (MEDIUM). Attack vector: Local. Complexity: Low. Privileges required: High. User interaction: None.

Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124. [CVSS 4.4 MEDIUM]

RemediationAI

Monitor vendor advisories for a patch.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.

Know when Agent gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

DescriptionCVE.org

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.

Executive ViewAI

Why It Matters

CVE-2025-11790 presents moderate security risk, a incorrect permissions vulnerability rated CVSS 4.4. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: manually tighten permissions on affected resources.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Data Quality
3 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available No
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

22
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +22
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:acronis:agent:*:*:*:*:*:*:*:*

Related Vulnerabilities in Acronis Cyber Protect Cloud Agent Credentials

View all 2

More in Agent

View all
CVE-2018-6703 CRITICAL
9.8 Dec 11

Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows re

CVE-2022-1257 MEDIUM POC
5.5 Apr 14

Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a loca

CVE-2016-3984 MEDIUM POC
5.1 Apr 08

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.

CVE-2021-1257 HIGH
8.8 Jan 20

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remot

CVE-2026-6788 HIGH
8.5 May 06

Local privilege escalation in WatchGuard Agent for Windows allows authenticated users to execute arbitrary code with ele

CVE-2026-6787 HIGH
8.5 May 06

Hard-coded cryptographic key in WatchGuard Agent for Windows enables local authenticated attackers to inject malicious c

CVE-2023-1388 HIGH
8.1 Jun 07

A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macm

CVE-2023-41743 HIGH
7.8 Aug 31

Local privilege escalation due to insecure driver communication port permissions. Rated high severity (CVSS 7.8), this v

CVE-2025-5480 HIGH
7.8 Jun 06

Local privilege escalation vulnerability in Action1 where an attacker with low-privileged code execution can exploit an

CVE-2026-28727 HIGH
7.8 Mar 06

Acronis Cyber Protect and Cloud Agent on macOS before specific builds contain an insecure Unix socket permissions vulner

CVE-2024-8996 HIGH
7.8 Sep 25

Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from L

CVE-2023-44209 HIGH
7.8 Oct 04

Local privilege escalation due to improper soft link handling. Rated high severity (CVSS 7.8), this vulnerability is low

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy