Acronis Cyber Infrastructure EUVD-2026-107160

Exploitation targets the Acronis Cyber Infrastructure (ACI) management/API layer where authorization checks are improperly enforced; per the vendor vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special non-default configuration is documented as required, so default-configured instances reachable over the network appear exploitable. The primary limiting factor is deployment exposure: ACI management interfaces are typically on restricted management networks rather than the public internet, and the affected builds are bounded to versions before 6.0.1-112, 6.1.1-64, and 6.2.1-71. Note the CWE-863 classification normally implies some pre-existing access, which is in tension with PR:N and should be verified against the advisory.

This is a genuine high-priority issue, though several real-world signals are absent. The vendor-supplied CVSS:3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, yielding high confidentiality and integrity impact - matching the CWE-863 'improper authorization' root cause and the 'Authentication Bypass' tag. However, there is a conceptual tension worth verifying: CWE-863 (incorrect authorization) typically presumes an authenticated-but-under-privileged actor, yet the vendor scored PR:N and tagged it 'Authentication Bypass', implying no credentials are needed - this discrepancy should be confirmed against the Acronis advisory. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation; the 9.1 is a theoretical-severity signal rather than a demonstrated-exploitation signal. Net: treat as a serious patch-soon item for ACI operators given the unauthenticated network vector, but it is not (yet) a confirmed in-the-wild emergency. Note also the vector is CVSS 3.0, not 3.1.

A remote attacker reaches the ACI management interface over the network and issues requests that the improper authorization logic fails to restrict, allowing them to read sensitive data and modify resources they should not control. No public proof-of-concept is available, but per the CVSS vector the attack is low-complexity and requires no authentication or user interaction, so a working request could be crafted directly from the advisory once details are known.