CVE-2026-87096 is a vulnerability in Acronis Cyber Infrastructure (ACI) involving improper authorization checks that can lead to sensitive information disclosure and manipulation. It affects versions before build 6.0.1-112, 6.1.1-64, and 6.2.1-71. The CVSS score is 3.3, indicating a low severity issue. No known exploits are reported in the wild, and no patch or remediation information is provided in the available data.
CVE-2026-87095 is a critical vulnerability in Acronis Cyber Infrastructure involving improper authorization checks, leading to sensitive information disclosure and manipulation. It affects versions before build 6.0.1-112, 6.1.1-64, and 6.2.1-71. The vulnerability has a CVSS 3.0 score of 9.1, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.
CVE-2026-87886 is a high-severity insecure file permissions vulnerability in the Acronis Backup plugin for cPanel & WHM and the Backup extension for Plesk. This flaw allows local privilege escalation by enabling attackers to gain elevated privileges on affected systems. The vulnerability has been exploited in the wild in limited, targeted attacks against the cPanel plugin. Acronis has released patches to address this issue and urges users to update immediately.
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.
Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.
CVE-2026-33271 is a local privilege escalation vulnerability in Acronis True Image for Windows versions before build 42902. It arises from insecure folder permissions (CWE-732), which could allow a local attacker with limited privileges to escalate their rights. The vulnerability has a CVSS 3.0 base score of 6.7, indicating medium severity. There is no information about an available patch or official vendor fix at this time. No known exploits in the wild have been reported. The vulnerability affects only local users and requires user interaction, with high impact on confidentiality, integrity, and availability if exploited.
CVE-2026-27774 is a local privilege escalation vulnerability in Acronis True Image for Windows versions before build 42902. It arises from a DLL hijacking issue (CWE-427) that could allow a local attacker to escalate privileges. The vulnerability has a CVSS 3.0 score of 6.7, indicating a medium severity level. No official patch or remediation details are provided in the available information. There are no known exploits in the wild at this time.
CVE-2026-28728 is a local privilege escalation vulnerability in Acronis True Image for Windows versions before build 42902. It arises from a DLL hijacking issue (CWE-427) that could allow an attacker with limited privileges to escalate their rights on the affected system. The vulnerability has a CVSS 3.0 base score of 6.7, indicating a medium severity level. No official patch or remediation information is currently available from the vendor. There are no known exploits in the wild at this time.
Sensitive information disclosure due to improper access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Sensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
