Acronis Cyber Protect EUVD-2026-111983

Exploitation requires the attacker to hold an adjacent-network machine-in-the-middle position on the connection used by the affected Acronis Cyber Protect 17 component (AV:A), because the flaw is the component's failure to verify the peer's SSL/TLS certificate - the attacker substitutes a forged certificate that the client accepts. Limiting factors: the attacker must already be positioned on the traffic path (not routable from the open Internet), the attack is rated high-complexity (AC:H), and the installation must be a build before 42587 on Linux or Windows; updating to build 42587 or later is the fix. The specific component, protocol, and whether any non-default configuration is involved are not described in the available sources.

This is a moderate-severity information-disclosure flaw (vendor CVSS 6.8, CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) rooted in missing SSL/TLS certificate verification (CWE-295) in one component of Acronis Cyber Protect 17. The CVSS vector itself tempers the raw score: AV:A limits the attacker to an adjacent network position rather than the open Internet, and AC:H reflects that a successful attack requires the attacker to already occupy a machine-in-the-middle position on the victim's traffic path - this is not a trivially remote, point-and-click issue. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no proof-of-concept or exploit reference was provided, so there is no public evidence of exploitation probability. The vuln.today priority is 'this_month' rather than act_now/emergency, which is consistent with a credential/data-exposure bug that depends on attacker positioning. Net: this is a legitimate confidentiality (and, per the vector, integrity) risk worth patching on a normal cycle, but the signals do not indicate an actively-exploited emergency; the dependence on an adjacent MITM position is the main factor keeping real-world risk below what the C:H/I:H impact alone would suggest. Note one conflict to verify with the vendor: CWE-295 MITM flaws are often scored AV:N, yet Acronis assigned AV:A - confirm whether the vulnerable channel is restricted to a local/adjacent segment.

An attacker who can position themselves on the network path between an Acronis Cyber Protect 17 component and the server/service it connects to (e.g. on a shared LAN, compromised router, or rogue access point) presents a fraudulent TLS certificate. Because the affected component does not properly verify the certificate, the attacker intercepts and decrypts the session, exposing sensitive information in transit, and per the CVSS integrity impact may also tamper with that traffic. No public exploit code or PoC reference was provided, and the high attack complexity reflects the need to first establish the man-in-the-middle position.