What is the CVSS score of CVE-2026-28719?

CVE-2026-28719 has a CVSS 3.0 base score of 4.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cyber Protect are affected by CVE-2026-28719?

CVE-2026-28719 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-28719?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Cyber Protect CVE-2026-28719

MEDIUM

Incorrect Authorization (CWE-863)

2026-03-06 security@acronis.com

Authentication Bypass Cyber Protect Windows

4.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

AnalysisAI

Acronis Cyber Protect 17 on Linux and Windows (before build 41186) fails to properly validate user permissions, allowing authenticated users to modify resources they should not have access to. The vulnerability requires valid credentials and does not enable remote code execution or denial of service, but could allow privilege escalation or unauthorized data manipulation within the application. No patch is currently available.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.