Acronis Cyber Protect CVE-2026-87103

Exploitation targets Acronis Cyber Protect 17 (Linux and Windows) on builds before 42587 and abuses improper token validation - per the CWE-347/'Jwt Attack' signals, an attacker who can present a forged or manipulated token to the server can be authenticated or authorized incorrectly. The CVSS vector marks it network-reachable and unauthenticated (AV:N/PR:N) with no user interaction (UI:N), but the high attack complexity (AC:H) indicates non-trivial, attacker-uncontrolled or hard-to-meet preconditions limit reliable exploitation; the precise trigger is not described in the available sources. The primary limiting factor is reachability of the Cyber Protect 17 management/service endpoint and the AC:H conditions; patching to build 42587 or later removes the flaw.

This is a moderate-to-serious issue whose real-world priority sits below the raw 7.4 score. The CVSS 3.0 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates a network-reachable, unauthenticated flaw (PR:N) with no user interaction, but with high attack complexity (AC:H), which materially tempers it - successful exploitation is not point-and-click. The CWE-347 classification plus the 'Jwt Attack' tag points to improper verification of a cryptographic signature (a forged or manipulated JSON Web Token), consistent with the 'improper token validation' description and the high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N). No CISA KEV listing, no EPSS score, and no PoC reference are present in the input, so there is no signal of active or widespread exploitation; the vendor.today decision label is 'this_week', i.e. prompt but not emergency remediation. SSVC-style signals (automatable, exploitation status) were not supplied. In short: a legitimate patch-this-week item for Acronis Cyber Protect 17 operators, not a drop-everything emergency, and the AC:H condition means it is more likely to be used in targeted rather than mass exploitation. Note the EPSS and SSVC data are missing, so the probability-of-exploitation picture is incomplete - verify against the Acronis advisory.

A remote, unauthenticated attacker crafts or tampers with an authentication/session token that the Acronis Cyber Protect 17 server fails to validate correctly, causing it to accept a forged or manipulated token. This lets the attacker read sensitive information and alter protected data without valid credentials. No public exploit was identified at the time of analysis, and the high attack complexity (AC:H) suggests non-trivial preconditions are needed to succeed.