Acronis Cyber Infrastructure
Monthly
Acronis Cyber Infrastructure (ACI) does not properly enforce authorization in its management/API layer, letting remote attackers disclose sensitive information and manipulate protected resources (CVSS 9.1, AV:N/AC:L/PR:N/UI:N, C:H/I:H). The vendor vector specifies PR:N, so no authentication, user interaction, or special configuration is documented as required; exposure is mainly bounded by whether the ACI management interface is reachable from untrusted networks. Affected deployments are those running builds earlier than 6.0.1-112, 6.1.1-64, and 6.2.1-71. No public exploit code and no CISA KEV entry were identified at time of analysis, so active exploitation is not confirmed.
Acronis Cyber Infrastructure before builds 6.0.1-112, 6.1.1-64, and 6.2.1-71 contains an improper authorization check (CWE-863) that allows a high-privileged authenticated user to read and modify sensitive data beyond the intended scope. The issued CVSS 3.3 vector (AV:N/AC:H/PR:H/UI:N/C:L/I:L/A:N) reflects network reachability but requires prior high-privilege access and difficult-to-reproduce conditions, with only partial confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation appears limited to specific authorized-but-overprivileged scenarios.
Acronis Cyber Infrastructure (ACI) does not properly enforce authorization in its management/API layer, letting remote attackers disclose sensitive information and manipulate protected resources (CVSS 9.1, AV:N/AC:L/PR:N/UI:N, C:H/I:H). The vendor vector specifies PR:N, so no authentication, user interaction, or special configuration is documented as required; exposure is mainly bounded by whether the ACI management interface is reachable from untrusted networks. Affected deployments are those running builds earlier than 6.0.1-112, 6.1.1-64, and 6.2.1-71. No public exploit code and no CISA KEV entry were identified at time of analysis, so active exploitation is not confirmed.
Acronis Cyber Infrastructure before builds 6.0.1-112, 6.1.1-64, and 6.2.1-71 contains an improper authorization check (CWE-863) that allows a high-privileged authenticated user to read and modify sensitive data beyond the intended scope. The issued CVSS 3.3 vector (AV:N/AC:H/PR:H/UI:N/C:L/I:L/A:N) reflects network reachability but requires prior high-privilege access and difficult-to-reproduce conditions, with only partial confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation appears limited to specific authorized-but-overprivileged scenarios.