CVE-2026-87095 in Cyber Infrastructure
Summary
by MITRE • 10/21/2026
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability in Acronis Cyber Infrastructure represents a critical failure in access control mechanisms, specifically manifesting as improper authorization checks that allow unauthorized actors to disclose sensitive information or manipulate system data. This class of flaw typically arises when an application fails to verify the privileges of a user before processing requests for protected resources or executing administrative functions. In the context of enterprise infrastructure management platforms like ACI, such weaknesses are particularly severe because they can expose configuration details, credentials, backup metadata, or allow attackers to alter system settings that govern data retention and security policies. The affected versions, including builds prior to 6.0.1-112, 6.1.1-64, and 6.2.1-71, indicate a systemic issue within the authentication and authorization logic of these specific releases, suggesting that the flaw is present across multiple major version branches during their respective development cycles.
From a technical perspective, this vulnerability aligns with CWE-862, which describes Missing Authorization, and often overlaps with CWE-200, Information Exposure. The operational mechanism likely involves an API endpoint or administrative interface where the server accepts requests without adequately validating whether the authenticated user possesses the necessary role-based permissions to perform the action. For instance, a standard end-user might be able to invoke functions intended only for system administrators by manipulating request parameters such as identifiers or tokens. This lack of strict enforcement allows attackers to bypass security boundaries established by the application design, leading to either the retrieval of confidential data that should remain isolated or the modification of critical infrastructure components. Such manipulation can disrupt service availability, compromise data integrity, and potentially serve as a foothold for further lateral movement within the network environment where ACI is deployed.
The impact on organizations utilizing these vulnerable versions extends beyond immediate data loss to include significant operational disruption and compliance risks. Since Acronis Cyber Infrastructure often manages backup operations and disaster recovery configurations across enterprise environments, unauthorized manipulation could lead to the deletion or corruption of backups, rendering an organization unable to recover from ransomware attacks or hardware failures. Furthermore, the disclosure of sensitive information may violate regulatory requirements such as GDPR, HIPAA, or PCI-DSS, depending on the nature of the data exposed. Attackers leveraging this flaw can escalate privileges within the management plane, potentially gaining control over connected storage systems and compute resources. This elevates the threat from a simple information leak to a potential full system compromise, impacting the confidentiality, integrity, and availability pillars of security.
To mitigate these risks, immediate action is required by upgrading Acronis Cyber Infrastructure to version 6.0.1-112 or later for the 6.0 branch, version 6.1.1-64 or later for the 6.1 branch, and version 6.2.1-71 or later for the 6.2 branch. These updated builds contain patches that enforce proper authorization checks at all critical entry points within the application logic. In addition to patching, organizations should implement network segmentation to restrict access to ACI management interfaces only from trusted administrative subnets. Deploying a Web Application Firewall can also provide an additional layer of defense by filtering out malicious requests that attempt to exploit known patterns associated with broken access control vulnerabilities. Regular security audits and penetration testing focused on role-based access controls are recommended to ensure that no other similar weaknesses exist within the infrastructure management stack, thereby maintaining robust protection against unauthorized disclosure and manipulation attacks as categorized under MITRE ATT&CK techniques related to privilege escalation and data exfiltration.