Acronis Cyber Protect CVE-2026-87098

Exploitation requires an authenticated session on Acronis Cyber Protect 17 (Linux or Windows) at a build before 42587 (PR:L), reached over the network (AV:N) without user interaction (UI:N). The improper authorization check (CWE-639) lets an authorized account access sensitive information outside its permitted scope. Limiting factors: the attacker must already hold valid low-privilege credentials, the vendor rates attack complexity as High (AC:H) indicating the trigger is not trivially reliable, and impact is confined to limited confidentiality disclosure (C:L) with no integrity or availability effect. The exact feature, endpoint, or key that must be manipulated is not described in the available sources. The vendor fix is build 42587; updating is the remediation stated in the advisory.

This is a low-priority issue across all available signals, not a high-CVSS-but-low-real-risk mismatch - the CVSS base score itself is only 3.1 (Low). The vendor-supplied CVSS:3.0 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) describes a network-reachable but high-complexity flaw that requires some level of privilege (PR:L, i.e. authenticated) and yields only limited confidentiality impact with no integrity or availability effect, consistent with CWE-639 (improper authorization / sensitive information disclosure). The vuln.today Decision label is 'monitor', the weakest urgency tier, and there is no KEV listing, no EPSS value supplied, and no exploit or PoC reference in the input. There is therefore no public exploit identified at time of analysis and no evidence of active exploitation; the convergence of a low base score, AC:H, PR:L, limited C-only impact, and a 'monitor' decision all point the same direction, with no conflicting signals. The main caveat is missing data rather than conflict: no EPSS probability, no independent (non-vendor) analysis, and the sole reference is the Acronis advisory, so the assessment rests entirely on vendor-reported metrics.

An authenticated but low-privileged user of an Acronis Cyber Protect 17 deployment manipulates a user-controlled identifier or request parameter so the server returns data belonging to another user or scope it should not expose, under conditions the vendor rates as high-complexity. No public exploit or PoC is identified, and the specific trigger is not described in the available sources.