CVE-2026-87879 is a vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 involving improper verification of cryptographic signatures. This flaw leads to sensitive information disclosure due to improper token validation. The vulnerability has a CVSS 3.0 score of 5.9, indicating medium severity. A fix is available in build 42587.
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
CVE-2026-87100 is a low-severity vulnerability in Acronis Cyber Protect 17 for Linux, caused by missing binary hardening in Linux executables. This protection mechanism failure affects versions before build 42587. The flaw could allow limited local attacker impact with low confidentiality and integrity consequences but no availability impact.
Acronis Cyber Protect 17 (Linux and Windows) before build 42587 contains a cross-site scripting (XSS) vulnerability due to improper input validation. This flaw allows an attacker with high privileges and user interaction to execute malicious scripts, potentially compromising confidentiality and integrity. The vulnerability has a medium severity score of 5.7 and is fixed in build 42587.
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
CVE-2026-87098 is an authorization bypass vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587. It allows sensitive information disclosure due to improper authorization involving a user-controlled key. The issue is fixed in build 42587.
Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Out-of-bounds Write vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVE-2026-87101 is a vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587 that involves improper verification of cryptographic signatures, leading to sensitive information disclosure. The flaw is due to improper token validation. A fix is available in build 42587.
CVE-2026-87097 is a vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587 that involves insufficiently protected credentials, leading to sensitive information disclosure. The flaw is classified under CWE-522. The vulnerability has a CVSS 3.0 base score of 5.3, indicating medium severity. A fix is available in build 42587.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS2025 and LTS2026 releases, contain a path traversal vulnerability (CWE-22). This flaw allows a high privileged remote attacker to potentially disclose sensitive information by bypassing pathname restrictions. The vulnerability has a CVSS 3.1 score of 6.8, indicating medium severity. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, and 8.3.1.50 respectively.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to credential exposure. The credentials may be used to access the system with privileges of the compromised user.
Infisical, a secrets management company, has raised $40 million in Series B funding, valuing it at $600 million. The company provides tools for managing secrets, encryption keys, digital certificates, and privileged access across cloud, on-premises, and AI infrastructures. Its Agent Vault technology enables AI agents to access sensitive systems without exposing underlying credentials by injecting secrets at a proxy and logging all requests. Over 1,300 organizations use Infisical's products. The funding will be used to enhance product development and AI agent security capabilities.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and certain LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a low privileged remote attacker to potentially disclose information by exploiting improper neutralization of special elements in SQL commands. The vulnerability has a medium severity with a CVSS score of 4.3. Fixed versions are available starting from 8.9.0.0 and corresponding LTS release updates.