Acronis Cyber Protect EUVD-2026-111988

Exploitation requires local access to a Linux host running Acronis Cyber Protect 17 at a build earlier than 42587, plus an existing low-privileged account (CVSS PR:L) - it is not remotely reachable (AV:L). The specific condition is that the product's Linux binaries are compiled/linked with the executable-stack (GNU_STACK RWE) attribute enabled, which removes the non-executable-stack mitigation. Limiting factors: the high attack complexity (AC:H) implies additional non-trivial preconditions must be met, no user interaction is involved (UI:N), and because an executable stack is an exploitation enabler rather than a direct flaw, meaningful impact realistically depends on a separate memory-corruption bug being present to chain against - the advisory does not describe such a trigger. The only complete fix stated is updating to build 42587 or later.

This is a moderate-severity protection-mechanism weakness (CWE-693), not a directly exploitable memory-corruption bug: Acronis Cyber Protect 17 (Linux) ships binaries with the executable-stack attribute enabled, which disables the NX/non-executable-stack mitigation and makes any separate memory-corruption flaw easier to turn into code execution. The input CVSS 3.0 vector (AV:L/AC:H/PR:L/UI:N, score 6.3) indicates a local attacker who already holds low privileges and must overcome high attack complexity, so this is a privilege-escalation / exploitation-enabler scenario rather than a remote entry point. Exploitation signals are weak: there is no CISA KEV listing and no EPSS score in the input, and the single reference is the Acronis vendor advisory (an advisory, not proof-of-concept exploit code), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' - a routine patch-this-cycle priority, not act_now/emergency - which is consistent with a defense-in-depth regression that requires a local foothold and another bug to be impactful. One tension to verify: the input tags this as 'Information Disclosure' and the CVSS claims C:H/I:H, yet an executable-stack regression is a mitigation failure that facilitates code execution rather than a direct confidentiality/integrity leak; the real-world impact depends on the presence of a chainable memory-corruption bug, which the advisory text does not describe.

A local attacker who has already obtained a low-privileged account on a Linux host running Acronis Cyber Protect 17 (build before 42587) leverages the executable-stack attribute on the product's binaries to execute injected shellcode when a separate memory-corruption condition is triggered, defeating the NX protection that would normally block it. Because the CVSS vector is AV:L/AC:H/PR:L, the attacker needs prior local access, must satisfy non-trivial preconditions, and no public exploit code is identified; the attack is an exploitation enabler rather than a standalone remote compromise.