Acronis Cyber Protect CVE-2026-87100

Exploitation requires local access to a system running Acronis Cyber Protect 17 on Linux (build before 42587) together with already-held low privileges on that host (AV:L, PR:L). Because this is missing binary hardening (CWE-693), it is not self-triggering: a separate memory-corruption or exploitation primitive in the affected binaries is needed, and the missing protections merely remove barriers to that separate attack - consistent with the high attack complexity (AC:H). Limiting factors: no remote vector, no unauthenticated path, limited confidentiality/integrity impact only, and no availability impact; patched build 42587 remediates it. The specific hardening features omitted are not enumerated in the available sources.

This is a low-severity defense-in-depth weakness, not a directly exploitable vulnerability. The vendor-supplied CVSS 3.0 vector (AV:L/AC:H/PR:L/UI:N/C:L/I:L/A:N, base 3.6) indicates local access, already-held low privileges, and high attack complexity with only limited confidentiality and integrity impact and no availability impact - all consistent with CWE-693 (Protection Mechanism Failure) caused by missing binary hardening (e.g. absent ASLR/stack-canary/RELRO/PIE compiler protections) rather than a flaw that itself grants access. The vuln.today Decision label is 'monitor', the lowest urgency tier, which agrees with the low CVSS. No EPSS score, no SSVC automatable/technical-impact data, and no KEV or POC signal were supplied, so exploitation probability cannot be quantified from this input; however, missing hardening is not independently exploitable - it only lowers the cost of exploiting some other memory-corruption bug in the same binaries, so its real-world risk is contingent on a separate primary vulnerability existing. Bottom line: genuinely low priority, correctly rated - remediate as routine patch hygiene, not an emergency.

An attacker who already has a local, low-privileged foothold on a host running Acronis Cyber Protect 17 for Linux, and who possesses a separate memory-corruption bug in one of its binaries, finds exploitation easier because the executables lack standard hardening protections. The missing hardening does not by itself grant any access or data. No public exploit code or PoC reference was provided in the input.