47
CVEs
5
Critical
14
High
1
KEV
1
PoC
11
Unpatched C/H
44.7%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
14
MEDIUM
25
LOW
3
Monthly CVE Trend
Affected Products (24)
Cyber Protect
65
Agent
33
Windows
28
Cyber Protect Home Office
12
Acronis Cyber Protect 17
11
True Image
9
Snap Deploy
7
Jwt Attack
5
Cyber Files
5
Cloud Manager
4
Acronis True Image
4
Acronis Devicelock Dlp
3
macOS
3
Acronis Cyber Protect Cloud Agent
3
Cyber Backup
2
Acronis Cyber Infrastructure
2
OpenSSL
2
Cyber Infrastructure
2
Cors Misconfiguration
1
Open Redirect
1
Acronis Backup
1
Cyber Protect Cloud
1
Acronis True Image Oem
1
Cyber Protection Agent
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-87886 | Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server. | HIGH | 7.8 | 0.3% | 89 |
KEV
|
| CVE-2025-30412 | Second improper authentication in Acronis Cyber Protect 16. CVSS 10.0. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2025-30411 | Improper authentication in Acronis Cyber Protect 16. CVSS 10.0. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2025-30416 | Missing authorization in Acronis Cyber Protect 16 allows sensitive data access. CVSS 10.0. | CRITICAL | 10.0 | 0.0% | 50 |
No patch
|
| CVE-2026-28710 | Improper authentication in Acronis Cyber Protect 17. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-87095 | Acronis Cyber Infrastructure (ACI) does not properly enforce authorization in its management/API layer, letting remote attackers disclose sensitive information and manipulate protected resources (CVSS 9.1, AV:N/AC:L/PR:N/UI:N, C:H/I:H). The vendor vector specifies PR:N, so no authentication, user interaction, or special configuration is documented as required; exposure is mainly bounded by whether the ACI management interface is reachable from untrusted networks. Affected deployments are those running builds earlier than 6.0.1-112, 6.1.1-64, and 6.2.1-71. No public exploit code and no CISA KEV entry were identified at time of analysis, so active exploitation is not confirmed. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-33092 | Local privilege escalation in Acronis True Image for macOS enables authenticated low-privileged users to gain elevated system privileges through improper environment variable handling. Affects Acronis True Image OEM (macOS) versions prior to build 42571 and Acronis True Image (macOS) prior to build 42902. Attackers with existing local access can achieve complete system compromise (high confidentiality, integrity, and availability impact). No public exploit identified at time of analysis. Exploitation requires low attack complexity with no user interaction. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2026-41220 | Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2026-41952 | Local privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud Agent (Windows, builds before 42183) allows a low-privileged local user to escalate to full system control through improper input validation. Classified as CWE-123 (write-what-where condition), successful exploitation yields total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the SSVC technical impact is rated total. | HIGH | 7.8 | 0.0% | 39 |
|
| CVE-2026-28727 | Acronis Cyber Protect and Cloud Agent on macOS before specific builds contain an insecure Unix socket permissions vulnerability that allows local authenticated users to escalate privileges and gain complete system control. An attacker with local access can exploit this misconfiguration to read sensitive data, modify system files, and execute arbitrary commands with elevated rights. No patch is currently available for this HIGH severity vulnerability. | HIGH | 7.8 | 0.0% | 39 |
No patch
|
| CVE-2026-28718 | Acronis Cyber Protect 17 on Linux and Windows versions prior to build 41186 is vulnerable to denial of service through improper input validation in authentication logging functions. An unauthenticated remote attacker can crash the application or render it unavailable without requiring user interaction. No patch is currently available for this vulnerability. | HIGH | 7.5 | 0.1% | 38 |
No patch
|
| CVE-2026-87102 | Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis. | HIGH | 7.4 | – | 37 |
|
| CVE-2026-87103 | Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present. | HIGH | 7.4 | – | 37 |
|
| CVE-2025-11792 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124. [CVSS 7.3 HIGH] | HIGH | 7.3 | 0.0% | 37 |
No patch
|
| CVE-2026-28721 | Acronis Cyber Protect 17 for Windows before build 41186 allows local attackers with standard user privileges to escalate to system-level access through improper handling of symbolic links. An authenticated attacker can exploit this vulnerability to gain full control over the affected system, including the ability to read, modify, or delete sensitive data and execute arbitrary code. No patch is currently available for this vulnerability. | HIGH | 7.3 | 0.0% | 37 |
No patch
|