Acronis Cyber Protect EUVD-2026-111987

Exploitation targets the token validation logic of Acronis Cyber Protect 17 (Linux and Windows) at builds earlier than 42587; the CVSS vector indicates a network-reachable path requiring no authentication and no user interaction. However, the flaw carries high attack complexity (AC:H), meaning the attacker must meet conditions beyond their direct control, and the specific trigger - what makes a token acceptance improper - is not described in the available Acronis advisory. The principal limiting factors are this elevated complexity and the version boundary: only deployments running builds before 42587 are affected, and upgrading to build 42587 or later is the vendor's stated fix.

This is a moderate-priority issue (vendor CVSS 7.4) that does not rise to emergency status. The CVSS 3.0 vector (AV:N/AC:H/PR:N/UI:N) indicates a network-reachable flaw requiring no privileges or user interaction, but with high attack complexity - meaning conditions outside the attacker's direct control must be met, which tempers real-world exploitability. Impact is significant on confidentiality and integrity (C:H/I:H) with no availability impact (A:N), consistent with an information-disclosure-and-manipulation flaw rooted in improper token validation (CWE-347). The vuln.today decision label is 'this_week', signaling prompt remediation rather than immediate crisis. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation or weaponization; this is a high-CVSS issue whose real-world urgency is tempered by the AC:H complexity and the absence of exploitation signals. Note a data-quality concern: the input carries a 'Microsoft' tag on what is an Acronis product, which appears mislabeled and should not drive vendor-based prioritization.

A remote, unauthenticated attacker crafts or tampers with an authentication/session token that the Acronis Cyber Protect 17 server fails to validate properly, allowing the attacker to read sensitive information and alter protected data. The high attack complexity (AC:H) implies the attacker must satisfy specific conditions that are not described in the available advisory, so exploitation is non-trivial. No public exploit was identified at time of analysis.