Acronis Cyber Protect EUVD-2026-111985

Exploitation requires an attacker with high privileges on the Acronis Cyber Protect 17 web management interface (per PR:H) who can submit data through a field with improper input validation, plus a second user who must interact with the malicious content (per UI:R) for the payload to fire. Attack complexity is rated high (AC:H) in the supplied vector; the exact trigger mechanism is not described in the available sources. Limiting factors that reduce realistic risk: the required high privilege level, the dependency on victim interaction, and the single-component scope. Affected and unpatched configurations are Acronis Cyber Protect 17 (Linux and Windows) before build 42587; updating to build 42587 is the fix stated by the vendor advisory.

This is a medium-severity (CVSS 5.7, CVSS:3.0 vector) stored/reflected XSS (CWE-79) that in real-world terms is a lower-priority issue despite a high confidentiality/integrity impact on paper. The CVSS vector itself constrains exploitability heavily: AV:N makes it network-reachable, but AC:H (high attack complexity), PR:H (attacker must already hold high privileges), and UI:R (a victim must interact) together mean an attacker needs to be an authenticated high-privilege user AND must lure another user into triggering the payload. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference were supplied, and the vendor priority label is 'this_month' rather than act_now/emergency - all signals point to routine patching rather than urgent response. One tension to verify: PR:H combined with an XSS primitive is unusual (an attacker who already has high privileges on the console generally has little to gain from scripting another session), so the realistic threat is privilege-boundary crossing or targeting a higher-privileged viewer; confirm the exact injecting-vs-viewing roles against the Acronis advisory. The A:N (no availability impact) and S:U (unchanged scope) in the input are also worth checking, since XSS typically executes in the victim's browser context.

An authenticated high-privilege user of the Acronis Cyber Protect 17 web console submits input that is not properly validated, planting a script payload. When another console user loads the affected view, the script executes in their browser session, potentially stealing session context or performing actions as that user. No public exploit code was identified, and successful exploitation depends on the attacker already holding high privileges and a victim interacting with the malicious content.