14
CVEs
1
Critical
4
High
1
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
6
LOW
3
Monthly CVE Trend
Affected Products (24)
Cyber Protect
65
Agent
33
Windows
28
Cyber Protect Home Office
12
Acronis Cyber Protect 17
11
True Image
9
Snap Deploy
7
Jwt Attack
5
Cyber Files
5
Cloud Manager
4
Acronis True Image
4
Acronis Devicelock Dlp
3
macOS
3
Acronis Cyber Protect Cloud Agent
3
Cyber Backup
2
Acronis Cyber Infrastructure
2
OpenSSL
2
Cyber Infrastructure
2
Cors Misconfiguration
1
Open Redirect
1
Acronis Backup
1
Cyber Protect Cloud
1
Acronis True Image Oem
1
Cyber Protection Agent
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-87886 | Local privilege escalation in the Acronis Backup integrations for cPanel & WHM, Plesk, and DirectAdmin on Linux allows an attacker who already holds a low-privileged account or shell on the host to tamper with plugin-installed files and directories left with insecure default permissions, gaining high-privilege code execution on the server. The flaw is confirmed actively exploited (CISA KEV) and carries a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction is needed and only low privileges are required, though exploitation is gated to hosts where one of the three control-panel plugins is installed and has not yet been upgraded to its fixed build. Because the vector is strictly local, remote attackers cannot reach it directly - they must first obtain a foothold or credentials on the server. | HIGH | 7.8 | 0.3% | 89 |
KEV
|
| CVE-2026-87095 | Acronis Cyber Infrastructure (ACI) does not properly enforce authorization in its management/API layer, letting remote attackers disclose sensitive information and manipulate protected resources (CVSS 9.1, AV:N/AC:L/PR:N/UI:N, C:H/I:H). The vendor vector specifies PR:N, so no authentication, user interaction, or special configuration is documented as required; exposure is mainly bounded by whether the ACI management interface is reachable from untrusted networks. Affected deployments are those running builds earlier than 6.0.1-112, 6.1.1-64, and 6.2.1-71. No public exploit code and no CISA KEV entry were identified at time of analysis, so active exploitation is not confirmed. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-87102 | Acronis Cyber Protect 17 on Linux and Windows before build 42587 can expose sensitive information and allow manipulation of protected resources through improper token validation, reachable over the network without authentication but requiring high attack complexity. Vendor CVSS is 7.4, and the this_week decision label makes this a moderate-priority remediation rather than an emergency. No public exploit code was identified at time of analysis. | HIGH | 7.4 | – | 37 |
|
| CVE-2026-87103 | Token forgery in Acronis Cyber Protect 17 before build 42587 can allow remote, unauthenticated attackers to bypass authentication or authorization, resulting in sensitive information disclosure and data manipulation on Linux and Windows installations. The CVSS 3.0 score is 7.4 with high attack complexity (AC:H), indicating non-trivial preconditions; no public exploit identified at time of analysis and no CISA KEV entry is present. | HIGH | 7.4 | – | 37 |
|
| CVE-2025-30414 | Local privilege escalation in Acronis Cyber Protect Cloud Agent (Windows) before build 42569 and Acronis Cyber Protect 17 (Windows) before build 42587 lets an authenticated local user with low privileges abuse improper authentication in the agent to reach high confidentiality and integrity impact. The weakness is CWE-1390 (improper authentication) and requires an existing local foothold on the Windows host - there is no remote vector and no user interaction is needed; availability is not affected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate, local-only risk rather than an emergency, though the vendor did report it and patched builds are available. | HIGH | 7.1 | – | 36 |
|
| CVE-2026-87880 | Missing SSL/TLS certificate verification in an Acronis Cyber Protect 17 component on Linux and Windows before build 42587 lets an unauthenticated attacker who can occupy an adjacent-network man-in-the-middle position present a forged certificate that the component accepts, causing confidentiality and integrity impact. The issue is rated CVSS 6.8 (AV:A/AC:H/PR:N/UI:N) and is fixed in build 42587; no public exploit was identified at time of analysis. | MEDIUM | 6.8 | – | 34 |
|
| CVE-2026-87878 | Acronis Cyber Protect 17 on Linux (builds earlier than 42587) ships binaries that are flagged with the executable-stack attribute, which disables the non-executable-stack (NX) hardening that normally stops injected data from being run as code. The weakness is local and requires an existing low-privileged account on the host (CVSS AV:L/PR:L) with additional non-trivial preconditions (AC:H); on its own it is a mitigation gap rather than a directly exploitable memory-corruption bug, and its real severity depends on whether a separate corruptible flaw exists on the host to chain against. There is no public exploit code and no confirmed active exploitation at time of analysis, and the only complete fix stated by the vendor is upgrading to build 42587 or later per advisory SEC-10003. | MEDIUM | 6.3 | – | 32 |
|
| CVE-2026-87101 | Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) allows a local attacker to disclose sensitive information, scored CVSS 6.2 with confidentiality-only impact and no authentication or user interaction required per the vector (AV:L/AC:L/PR:N/UI:N). The weakness class (CWE-347, improper verification of cryptographic signatures) combined with the JWT/token tagging indicates the token verification logic can be bypassed, exposing data the token was meant to protect. The flaw is not remotely reachable: an attacker needs local presence on the host, and no public exploit code or CISA KEV entry is identified at time of analysis; Acronis has published advisory SEC-9812 and fixes the issue in build 42587. | MEDIUM | 6.2 | – | 31 |
|
| CVE-2026-87879 | Improper token validation in Acronis Cyber Protect 17 on Linux and Windows (builds before 42587) lets remote attackers potentially disclose sensitive information without authenticating. The CVSS vector (AV:N/AC:H/PR:N/UI:N, confidentiality-only) marks it as a moderate, mid-priority issue rather than a top-of-queue emergency, and the exploit path is not straightforward because of the high attack complexity. No public exploit code has been identified at the time of analysis, and the vendor identifies updating to build 42587 or later as the only complete fix. | MEDIUM | 5.9 | – | 30 |
|
| CVE-2026-87099 | Cross-site scripting in Acronis Cyber Protect 17 before build 42587 allows a high-privileged user on the web management interface to submit improperly validated input that a second user must interact with before script executes. The issue is rated CVSS 5.7 with the supplied CVSS:3.0 vector AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N, but the independent assessment treats real-world risk as medium and lower-priority because of the high privilege requirement, required victim interaction, and single-component scope; the trigger mechanism is not described in available sources. No public exploit was identified at time of analysis, and the vendor fix is build 42587 for Linux and Windows. | MEDIUM | 5.7 | – | 28 |
|
| CVE-2026-87097 | Acronis Cyber Protect 17 builds prior to 42587 on Linux and Windows store or transmit credentials with insufficient protection (CWE-522), allowing an attacker who already holds a low-privilege authenticated account to obtain those credentials over the network. The vendor rates the attack as high complexity, and the available advisory does not describe the specific conditions that must be met to trigger the disclosure; integrity and availability are unaffected, but confidentiality impact is high. No public exploit code or PoC reference is identified in the available sources, and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not provided, and the priority decision is this_month. Risk is moderated by the need for valid authenticated access, the high attack complexity and the availability of a fixed build. | MEDIUM | 5.3 | – | 26 |
|
| CVE-2026-87100 | Acronis Cyber Protect 17 on Linux builds before 42587 ship executables that lack complete binary hardening protections (CWE-693), which can make a separate local memory-corruption or exploitation primitive easier to carry out but is not directly exploitable on its own. Abuse requires local access and existing low privileges with high attack complexity, and the resulting impact is limited to low confidentiality and integrity effects with no availability impact. No public exploit identified at time of analysis, and the vendor-released patch is build 42587. | LOW | 3.6 | – | 18 |
|
| CVE-2026-87096 | Acronis Cyber Infrastructure before builds 6.0.1-112, 6.1.1-64, and 6.2.1-71 contains an improper authorization check (CWE-863) that allows a high-privileged authenticated user to read and modify sensitive data beyond the intended scope. The issued CVSS 3.3 vector (AV:N/AC:H/PR:H/UI:N/C:L/I:L/A:N) reflects network reachability but requires prior high-privilege access and difficult-to-reproduce conditions, with only partial confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation appears limited to specific authorized-but-overprivileged scenarios. | LOW | 3.3 | 0.1% | 17 |
|
| CVE-2026-87098 | Acronis Cyber Protect 17 builds before 42587 contain an improper authorization flaw (CWE-639) that lets an authenticated low-privilege account read sensitive information outside its permitted scope on Linux and Windows installations. The vendor rates the issue Low severity (CVSS 3.1) with High attack complexity and confined confidentiality impact, and no public exploit was identified at time of analysis; priority is monitor. | LOW | 3.1 | – | 16 |
|