Acronis Cyber Protect 17
Monthly
Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis.
Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present.
Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) lets remote attackers potentially disclose sensitive information without authenticating. The CVSS vector (AV:N/AC:H/PR:N/UI:N, confidentiality-only) marks it as a moderate, mid-priority issue rather than a top-of-queue emergency, and the exploit path is not straightforward because of the high attack complexity. No public exploit code has been identified at the time of analysis, and the vendor identifies updating to build 42587 or later as the only complete fix.
Acronis Cyber Protect 17 on Linux (builds earlier than 42587) ships binaries that are flagged with the executable-stack attribute, which disables the non-executable-stack (NX) hardening that normally stops injected data from being run as code. The weakness is local and requires an existing low-privileged account on the host (CVSS AV:L/PR:L) with additional non-trivial preconditions (AC:H); on its own it is a mitigation gap rather than a directly exploitable memory-corruption bug, and its real severity depends on whether a separate corruptible flaw exists on the host to chain against. There is no public exploit code and no confirmed active exploitation at time of analysis, and the only complete fix stated by the vendor is upgrading to build 42587 or later per advisory SEC-10003.
Acronis Cyber Protect 17 on Linux builds before 42587 ship executables that lack complete binary hardening protections (CWE-693), which can make a separate local memory-corruption or exploitation primitive easier to carry out but is not directly exploitable on its own. Abuse requires local access and existing low privileges with high attack complexity, and the resulting impact is limited to low confidentiality and integrity effects with no availability impact. No public exploit identified at time of analysis, and the vendor-released patch is build 42587.
Cross-site scripting in Acronis Cyber Protect 17 before build 42587 allows a high-privileged user on the web management interface to submit improperly validated input that a second user must interact with before script executes. The issue is rated CVSS 5.7 with the supplied CVSS:3.0 vector AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N, but the independent assessment treats real-world risk as medium and lower-priority because of the high privilege requirement, required victim interaction, and single-component scope; the trigger mechanism is not described in available sources. No public exploit was identified at time of analysis, and the vendor fix is build 42587 for Linux and Windows.
Local privilege escalation in Acronis Cyber Protect Cloud Agent (Windows) before build 42569 and Acronis Cyber Protect 17 (Windows) before build 42587 lets an authenticated local user with low privileges abuse improper authentication in the agent to reach high confidentiality and integrity impact. The weakness is CWE-1390 (improper authentication) and requires an existing local foothold on the Windows host - there is no remote vector and no user interaction is needed; availability is not affected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate, local-only risk rather than an emergency, though the vendor did report it and patched builds are available.
Acronis Cyber Protect 17 builds before 42587 contain an improper authorization flaw (CWE-639) that lets an authenticated low-privilege account read sensitive information outside its permitted scope on Linux and Windows installations. The vendor rates the issue Low severity (CVSS 3.1) with High attack complexity and confined confidentiality impact, and no public exploit was identified at time of analysis; priority is monitor.
Missing SSL/TLS certificate verification in an Acronis Cyber Protect 17 component on Linux and Windows before build 42587 lets an unauthenticated attacker who can occupy an adjacent-network man-in-the-middle position present a forged certificate that the component accepts, causing confidentiality and integrity impact. The issue is rated CVSS 6.8 (AV:A/AC:H/PR:N/UI:N) and is fixed in build 42587; no public exploit was identified at time of analysis.
Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) allows a local attacker to disclose sensitive information, scored CVSS 6.2 with confidentiality-only impact and no authentication or user interaction required per the vector (AV:L/AC:L/PR:N/UI:N). The weakness class (CWE-347, improper verification of cryptographic signatures) combined with the JWT/token tagging indicates the token verification logic can be bypassed, exposing data the token was meant to protect. The flaw is not remotely reachable: an attacker needs local presence on the host, and no public exploit code or CISA KEV entry is identified at time of analysis; Acronis has published advisory SEC-9812 and fixes the issue in build 42587.
Acronis Cyber Protect 17 builds prior to 42587 on Linux and Windows store or transmit credentials with insufficient protection (CWE-522), allowing an attacker who already holds a low-privilege authenticated account to obtain those credentials over the network. The vendor rates the attack as high complexity, and the available advisory does not describe the specific conditions that must be met to trigger the disclosure; integrity and availability are unaffected, but confidentiality impact is high. No public exploit code or PoC reference is identified in the available sources, and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not provided, and the priority decision is this_month. Risk is moderated by the need for valid authenticated access, the high attack complexity and the availability of a fixed build.
Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis.
Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present.
Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) lets remote attackers potentially disclose sensitive information without authenticating. The CVSS vector (AV:N/AC:H/PR:N/UI:N, confidentiality-only) marks it as a moderate, mid-priority issue rather than a top-of-queue emergency, and the exploit path is not straightforward because of the high attack complexity. No public exploit code has been identified at the time of analysis, and the vendor identifies updating to build 42587 or later as the only complete fix.
Acronis Cyber Protect 17 on Linux (builds earlier than 42587) ships binaries that are flagged with the executable-stack attribute, which disables the non-executable-stack (NX) hardening that normally stops injected data from being run as code. The weakness is local and requires an existing low-privileged account on the host (CVSS AV:L/PR:L) with additional non-trivial preconditions (AC:H); on its own it is a mitigation gap rather than a directly exploitable memory-corruption bug, and its real severity depends on whether a separate corruptible flaw exists on the host to chain against. There is no public exploit code and no confirmed active exploitation at time of analysis, and the only complete fix stated by the vendor is upgrading to build 42587 or later per advisory SEC-10003.
Acronis Cyber Protect 17 on Linux builds before 42587 ship executables that lack complete binary hardening protections (CWE-693), which can make a separate local memory-corruption or exploitation primitive easier to carry out but is not directly exploitable on its own. Abuse requires local access and existing low privileges with high attack complexity, and the resulting impact is limited to low confidentiality and integrity effects with no availability impact. No public exploit identified at time of analysis, and the vendor-released patch is build 42587.
Cross-site scripting in Acronis Cyber Protect 17 before build 42587 allows a high-privileged user on the web management interface to submit improperly validated input that a second user must interact with before script executes. The issue is rated CVSS 5.7 with the supplied CVSS:3.0 vector AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N, but the independent assessment treats real-world risk as medium and lower-priority because of the high privilege requirement, required victim interaction, and single-component scope; the trigger mechanism is not described in available sources. No public exploit was identified at time of analysis, and the vendor fix is build 42587 for Linux and Windows.
Local privilege escalation in Acronis Cyber Protect Cloud Agent (Windows) before build 42569 and Acronis Cyber Protect 17 (Windows) before build 42587 lets an authenticated local user with low privileges abuse improper authentication in the agent to reach high confidentiality and integrity impact. The weakness is CWE-1390 (improper authentication) and requires an existing local foothold on the Windows host - there is no remote vector and no user interaction is needed; availability is not affected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate, local-only risk rather than an emergency, though the vendor did report it and patched builds are available.
Acronis Cyber Protect 17 builds before 42587 contain an improper authorization flaw (CWE-639) that lets an authenticated low-privilege account read sensitive information outside its permitted scope on Linux and Windows installations. The vendor rates the issue Low severity (CVSS 3.1) with High attack complexity and confined confidentiality impact, and no public exploit was identified at time of analysis; priority is monitor.
Missing SSL/TLS certificate verification in an Acronis Cyber Protect 17 component on Linux and Windows before build 42587 lets an unauthenticated attacker who can occupy an adjacent-network man-in-the-middle position present a forged certificate that the component accepts, causing confidentiality and integrity impact. The issue is rated CVSS 6.8 (AV:A/AC:H/PR:N/UI:N) and is fixed in build 42587; no public exploit was identified at time of analysis.
Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) allows a local attacker to disclose sensitive information, scored CVSS 6.2 with confidentiality-only impact and no authentication or user interaction required per the vector (AV:L/AC:L/PR:N/UI:N). The weakness class (CWE-347, improper verification of cryptographic signatures) combined with the JWT/token tagging indicates the token verification logic can be bypassed, exposing data the token was meant to protect. The flaw is not remotely reachable: an attacker needs local presence on the host, and no public exploit code or CISA KEV entry is identified at time of analysis; Acronis has published advisory SEC-9812 and fixes the issue in build 42587.
Acronis Cyber Protect 17 builds prior to 42587 on Linux and Windows store or transmit credentials with insufficient protection (CWE-522), allowing an attacker who already holds a low-privilege authenticated account to obtain those credentials over the network. The vendor rates the attack as high complexity, and the available advisory does not describe the specific conditions that must be met to trigger the disclosure; integrity and availability are unaffected, but confidentiality impact is high. No public exploit code or PoC reference is identified in the available sources, and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not provided, and the priority decision is this_month. Risk is moderated by the need for valid authenticated access, the high attack complexity and the availability of a fixed build.