Acronis Cyber Protect 17 EUVD-2026-111979

Exploitation requires network access to Acronis Cyber Protect 17 plus a low-privilege authenticated account (PR:L), and the vendor rates the attack as high-complexity (AC:H), implying conditions outside the attacker's full control must be met - though the advisory text provided does not describe what those conditions are, so the exact trigger is not described in the available sources. No user interaction is needed (UI:N). Impact is limited to disclosure of insufficiently protected credentials (C:H only; no integrity or availability impact). Limiting factors for defenders: the requirement for valid authenticated credentials and the high complexity reduce the realistic attack surface, and only builds before 42587 (Linux and Windows) are affected - updating to build 42587 or later removes the exposure.

This is a moderate-severity information-disclosure issue (CVSS 3.0 base 5.3, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) stemming from insufficiently protected credentials (CWE-522) in Acronis Cyber Protect 17. The signals are internally consistent but point to limited real-world urgency: the vector requires low-privilege authentication (PR:L) and carries high attack complexity (AC:H), while impact is confined to confidentiality (C:H, I:N, A:N) - i.e., exposure of credentials rather than code execution or system takeover. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no POC or exploit reference is present, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', indicating a prioritized-but-not-emergency remediation cadence rather than act_now/emergency. Net: this is a legitimate credential-exposure flaw worth patching on a normal monthly cycle, not a high-CVSS-but-illusory issue, but neither is it a drop-everything emergency - the authentication requirement and high complexity meaningfully constrain exploitation. One data caveat: AC:H is asserted by the vendor vector but the advisory text provided does not describe the trigger mechanism, so the precise conditions behind the 'high complexity' rating cannot be verified from the available sources.

A low-privileged but authenticated user (or an attacker who has already obtained such an account) interacts over the network with Acronis Cyber Protect 17 and, under the specific conditions the vendor rates as high-complexity, is able to read credentials that the product fails to protect adequately. Those recovered credentials could then be reused to access backup data, management interfaces, or other connected systems. No public exploit code or POC reference was provided, and the trigger is not described in the available sources.