146
CVEs
11
Critical
70
High
1
KEV
2
PoC
66
Unpatched C/H
24.7%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
70
MEDIUM
62
LOW
3
Monthly CVE Trend
Affected Products (24)
Cyber Protect
65
Agent
33
Windows
28
Cyber Protect Home Office
12
Acronis Cyber Protect 17
11
True Image
9
Snap Deploy
7
Jwt Attack
5
Cyber Files
5
Cloud Manager
4
Acronis True Image
4
Acronis Devicelock Dlp
3
macOS
3
Acronis Cyber Protect Cloud Agent
3
Cyber Backup
2
Acronis Cyber Infrastructure
2
OpenSSL
2
Cyber Infrastructure
2
Cors Misconfiguration
1
Open Redirect
1
Acronis Backup
1
Cyber Protect Cloud
1
Acronis True Image Oem
1
Cyber Protection Agent
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-87886 | Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server. | HIGH | 7.8 | 0.3% | 89 |
KEV
|
| CVE-2020-16171 | An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 5.5% | 52 |
PoC
No patch
|
| CVE-2025-30412 | Second improper authentication in Acronis Cyber Protect 16. CVSS 10.0. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2025-30411 | Improper authentication in Acronis Cyber Protect 16. CVSS 10.0. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2025-30416 | Missing authorization in Acronis Cyber Protect 16 allows sensitive data access. CVSS 10.0. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2026-28710 | Improper authentication in Acronis Cyber Protect 17. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2023-41746 | Remote command execution due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.1% | 49 |
No patch
|
| CVE-2023-41748 | Remote command execution due to improper input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.1% | 49 |
No patch
|
| CVE-2026-87095 | Acronis Cyber Infrastructure (ACI) does not properly enforce authorization in its management/API layer, letting remote attackers disclose sensitive information and manipulate protected resources (CVSS 9.1, AV:N/AC:L/PR:N/UI:N, C:H/I:H). The vendor vector specifies PR:N, so no authentication, user interaction, or special configuration is documented as required; exposure is mainly bounded by whether the ACI management interface is reachable from untrusted networks. Affected deployments are those running builds earlier than 6.0.1-112, 6.1.1-64, and 6.2.1-71. No public exploit code and no CISA KEV entry were identified at time of analysis, so active exploitation is not confirmed. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2023-44208 | Sensitive information disclosure and manipulation due to missing authorization. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.1 | 0.1% | 46 |
No patch
|
| CVE-2023-44152 | Sensitive information disclosure and manipulation due to improper authentication. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.1 | 0.6% | 46 |
No patch
|
| CVE-2023-44206 | Sensitive information disclosure and manipulation due to improper authorization. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.1 | 0.8% | 46 |
No patch
|
| CVE-2024-49388 | Sensitive information manipulation due to improper authorization. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2017-3219 | Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2021-32581 | Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.1 | 0.7% | 40 |
No patch
|