What is the CVSS score of CVE-2026-28713?

CVE-2026-28713 has a CVSS 3.0 base score of 7.1 (High). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Cyber Protect are affected by CVE-2026-28713?

Virtual appliance deployments of Acronis Cyber Protect Cloud Agent and Cyber Protect 17 on VMware infrastructure contain hard-coded default credentials that could allow unauthorized local privileged…

How to fix or mitigate CVE-2026-28713?

Within 24 hours: Identify and inventory all Acronis Virtual Appliance deployments on VMware with affected builds (Cloud Agent <36943, Cyber Protect 17 <41186); isolate systems from production networks if possible. Within 7 days: Implement mandatory credential rotation for all local privileged accounts on affected appliances and restrict network access via firewall rules to authorized administrators only. Within 30 days: Upgrade to patched builds (36943+ and 41186+) or migrate to alternative backup solutions; monitor vendor security advisories for patch availability.

Cyber Protect CVE-2026-28713

HIGH

Use of Default Credentials (CWE-1392)

2026-03-06 security@acronis.com

Information Disclosure Cyber Protect Agent

7.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 00:16 nvd

HIGH 7.1

DescriptionCVE.org

Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.

AnalysisAI

Acronis Cyber Protect and Agent virtual appliances on VMware contain hardcoded default credentials for local privileged accounts, allowing attackers with network access and user interaction to gain high-level system access and potentially modify or disrupt backup operations. The vulnerability affects Cyber Protect Cloud Agent (VMware) before build 36943 and Cyber Protect 17 (VMware) before build 41186, with no patch currently available. An attacker exploiting this could achieve privilege escalation and lateral movement within virtualized environments.