Acronis Cyber Protect 17 EUVD-2026-111980

Exploitation requires local access to a system running Acronis Cyber Protect 17 on Linux or Windows at a build before 42587 (AV:L), and targets the product's token validation logic (consistent with the JWT/token tag and CWE-347). No authentication is required per the CVSS vector (PR:N) and no user interaction is needed (UI:N). The limiting factor is the local attack vector: the flaw is not scored as remotely reachable, so an attacker must already have a foothold or local presence on the host; impact is confined to confidentiality (information disclosure), with no integrity or availability effect. The exact feature path and why access is local-only are not described in the available sources.

This is a moderate-severity information disclosure flaw (CVSS 6.2, vendor-supplied CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) stemming from improper token validation (CWE-347) in Acronis Cyber Protect 17. The signals point to a real-but-non-urgent issue rather than an emergency: the vuln.today decision label is 'this_month' (not act_now or emergency), there is no CISA KEV listing, no EPSS score was provided, and the only reference is the Acronis vendor advisory rather than any exploit code. The CVSS vector reports AV:L (local attack vector) combined with PR:N (no privileges) and high confidentiality impact only - meaning an unauthenticated actor with local access can read sensitive data but cannot modify it or affect availability. Note a tension worth verifying with the vendor: improper token/JWT validation flaws are frequently network-reachable API issues, yet the vendor scored this AV:L; the public description does not explain how local-only access is required, so the trigger mechanism is not described in the available sources. No EPSS, KEV, or POC data contradicts the low-urgency read, so overall this is a legitimate patch-this-cycle item rather than a drop-everything priority.

An actor with local access to a host running Acronis Cyber Protect 17 (before build 42587) exploits weak token validation to obtain a sensitive token or the data it protects, then reads information they should not be authorized to see. No authentication is required per the CVSS vector (PR:N), but the vector indicates local access (AV:L) is needed. No public exploit identified at time of analysis.