CVE-2026-87096 in Cyber Infrastructure
Summary
by MITRE • 10/21/2026
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described involves a critical failure in access control mechanisms within specific versions of Acronis Cyber Infrastructure, specifically builds prior to 6.0.1-112, 6.1.1-64, and 6.2.1-71. This flaw stems from improper authorization checks that allow unauthorized actors to interact with sensitive system components in ways they should not be permitted. In enterprise storage environments like ACI, which manages distributed data across multiple nodes, the integrity of access control is paramount because these systems often handle large volumes of critical business data and configuration settings. When authorization logic fails to properly validate user permissions before processing requests, it creates a pathway for attackers to bypass security boundaries that are designed to isolate administrative functions from standard user operations or external threats.
From a technical perspective, this issue aligns with CWE-269, which classifies Improper Privilege Control vulnerabilities where an actor is granted privileges they do not possess. The root cause typically lies in the application logic failing to enforce role-based access control policies consistently across all API endpoints and administrative interfaces. For instance, an authenticated user with limited privileges might be able to execute commands or modify configurations that are reserved for system administrators. This lack of strict enforcement allows for both information disclosure and state manipulation. The former occurs when sensitive data such as encryption keys, node topology details, or backup metadata is exposed through unauthenticated or improperly authorized API calls. The latter involves the ability to alter system settings, potentially disrupting service availability or compromising data integrity by modifying replication policies or storage pool configurations without proper oversight.
The operational impact of this vulnerability can be severe for organizations relying on Acronis Cyber Infrastructure for their disaster recovery and backup strategies. If an attacker successfully exploits these improper authorization checks, they could exfiltrate sensitive configuration details that reveal the internal network architecture, making subsequent lateral movement easier within the organization's infrastructure. Furthermore, the ability to manipulate system settings means an adversary could disable security features, alter retention policies to delete critical backups, or corrupt storage pools leading to data loss. In a scenario where ACI is integrated with broader enterprise identity management systems, this vulnerability could serve as an initial foothold for more sophisticated attacks targeting the entire backup infrastructure, undermining the organization's resilience against ransomware and other destructive threats.
This type of flaw is also associated with MITRE ATT&CK technique T1078, Valid Accounts, particularly when exploited by attackers who have obtained low-level credentials but seek to escalate privileges or access restricted resources due to flawed server-side validation. It may also relate to T1530, Data from Cloud Storage Object, if the vulnerability allows direct reading of stored objects without proper authentication checks on those specific endpoints. The absence of robust authorization middleware ensures that requests are processed based on identity rather than verified permission sets, which is a fundamental security anti-pattern in modern web and API architectures.
To mitigate this risk, organizations must immediately upgrade Acronis Cyber Infrastructure to build 6.0.1-112 or later for the 6.0 branch, build 6.1.1-64 or later for the 6.1 branch, and build 6.2.1-71 or later for the 6.2 branch. These updates contain patches that enforce stricter authorization checks on all administrative endpoints and API calls. Until upgrades are applied, administrators should implement network-level controls such as firewall rules to restrict access to ACI management interfaces only from trusted IP addresses and admin workstations. Additionally, enabling comprehensive audit logging can help detect anomalous behavior indicative of exploitation attempts, although this is a compensatory control rather than a fix for the underlying code defect. Regular security assessments and penetration testing should be conducted post-upgrade to verify that access controls are functioning as intended across all service components.