EUVD-2026-107161
GHSA-w28j-37x5-4v96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with high-privilege account
-
ExploitAbuse improper authorization check
-
ImpactDisclose or manipulate out-of-scope sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an already-authenticated account holding high privileges (PR:H) within Acronis Cyber Infrastructure, combined with high attack complexity (AC:H) conditions that are not reliably reproducible. Exploitation is limited to the specific resources exposed by the flawed authorization check, yielding only partial read (C:L) and partial modification (I:L) of sensitive data and no availability impact. Limiting factors: the attacker must first obtain high-privilege access, no anonymous or low-privilege path exists per the vector, and the affected builds (ACI before 6.0.1-112 / 6.1.1-64 / 6.2.1-71) must be in use - patched builds remediate the condition. |
| Impact | This is a low-priority issue despite being a real authorization flaw. The CVSS 3.0 base score is 3.3 (Low) with vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N, meaning exploitation requires an attacker who already holds high privileges on the system (PR:H), faces high attack complexity (AC:H), and gains only limited confidentiality and integrity impact (C:L/I:L) with no availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there are no signals of active or likely exploitation. The CWE-863 (Incorrect Authorization) classification is consistent with the PR:H vector - this is a privilege/scope escalation by an already-authenticated high-privilege user, not a pre-auth break. CONFLICT TO NOTE: the input Tag 'Authentication Bypass' contradicts both the CWE-863 (improper authorization, not authentication) and the PR:H metric (high privileges required, not bypassed) - verify with the Acronis advisory, as this appears to be a mislabeled tag. Overall this is a high-CVSS-but-low-real-risk-style finding inverted: it is correctly scored low and warrants routine patching rather than emergency response. |
| Exploit ScenarioDerived | An authenticated administrator or high-privilege tenant user of Acronis Cyber Infrastructure leverages an improper authorization check to read or modify sensitive resources belonging to other tenants or scopes they should not control. Because the vector is AV:N but requires high privileges (PR:H) and high attack complexity (AC:H), the realistic actor is an insider or a compromised privileged account rather than an anonymous remote attacker. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Acronis Cyber Infrastructure before builds 6.0.1-112, 6.1.1-64, and 6.2.1-71 contains an improper authorization check (CWE-863) that allows a high-privileged authenticated user to read and modify sensitive data beyond the intended scope. The issued CVSS 3.3 vector (AV:N/AC:H/PR:H/UI:N/C:L/I:L/A:N) reflects network reachability but requires prior high-privilege access and difficult-to-reproduce conditions, with only partial confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation appears limited to specific authorized-but-overprivileged scenarios.
RemediationAI
Upgrade Acronis Cyber Infrastructure to build 6.0.1-112, 6.1.1-64, or 6.2.1-71 according to the deployed release line, as documented in vendor advisory SEC-8129 (https://security-advisory.acronis.com/advisories/SEC-8129). If an immediate upgrade is not possible, restrict network access to the ACI management and API interfaces to trusted administrative networks, review and reduce high-privilege role assignments to the minimum necessary, and monitor audit logs for unexpected cross-scope reads or modifications by privileged accounts; these controls lower exposure but do not correct the underlying authorization flaw and can complicate legitimate administration or break integrations that rely on broad access. Vendor-released patch: ACI builds 6.0.1-112, 6.1.1-64, and 6.2.1-71.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-863 (Incorrect Authorization) indicates that Acronis Cyber Infrastructure enforces authorization rules incorrectly, allowing an authenticated high-privileged user to access operations or resources outside their intended role. The CPE entries identify acronis_cyber_infrastructure as the affected product across multiple release lines, and the CVSS vector shows the flaw is reachable over the network (AV:N) but requires high privileges (PR:H) and high attack complexity (AC:H) to exploit. Successful exploitation yields only low confidentiality (C:L) and low integrity (I:L) impact, with no availability (A:N) effect, meaning the attacker can read and alter a limited set of sensitive data exposed by the flawed check but cannot disrupt service. The issue is remediated in fixed builds 6.0.1-112, 6.1.1-64, and 6.2.1-71, so deployments on earlier builds remain exposed.
Know when Acronis Cyber Infrastructure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Network-reachable management interface (AV:N) but requires high-privilege access (PR:H) and hard-to-meet conditions (AC:H); improper authorization yields only limited read and write (C:L/I:L), no availability loss.
Primary rating from Vendor (Acronis).
CVSS VectorVendor: Acronis
Lifecycle Timeline
1DescriptionCVE.org
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB