Acronis Cyber Protect 17 EUVD-2026-111989

Exploitation requires network reachability to an Acronis Cyber Protect 17 instance (Linux or Windows) running a build before 42587; no authentication is required (PR:N) and no user interaction (UI:N). The defect is improper token/signature validation (CWE-347), so the attack centers on presenting a token that the server fails to validate correctly; however, the exact feature, endpoint, or token flow that must be exercised is not described in the available sources, and the trigger is not detailed. Limiting factors: the CVSS high attack complexity (AC:H) indicates exploitation is not straightforward, and impact is confined to confidentiality (information disclosure) with no integrity or availability effect. The only complete fix stated by the vendor is updating to build 42587 or later.

This is a moderate-severity, mid-priority issue rather than a top-of-queue emergency. The CVSS 3.0 vector (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, 5.9) describes a network-reachable, unauthenticated (PR:N) flaw with high attack complexity (AC:H) that impacts confidentiality only (C:H), with no integrity or availability effect. CWE-347 (improper verification of a cryptographic signature) combined with the 'Jwt Attack' tag points to a token-signature-validation weakness, consistent with 'improper token validation' in the description. No EPSS score is provided in the input, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present, so the exploitation signal is weak: this is best treated as a confidentiality-protection patch, not an actively-exploited threat. The vendor-assigned priority is 'this_month' (vuln.today Decision label), which aligns with the moderate score and absence of active-exploitation evidence. The AC:H rating indicates exploitation is not trivial, but the available sources do not describe how the flaw is triggered, so the specific conditions that make it complex are not confirmed. Note also a metadata inconsistency: the input carries a 'Microsoft' tag on what is an Acronis product - see data_quality_flags.

A remote attacker who can reach the Acronis Cyber Protect 17 service over the network crafts or manipulates an authentication/session token in a way that bypasses proper signature or token validation, causing the server to disclose sensitive information it should not return. No valid credentials are required (PR:N), but the high attack complexity (AC:H) suggests the attack is not a simple single request. No public exploit identified at time of analysis.