CVE-2026-87098 in Cyber Protect
Summary
by MITRE • 10/28/2026
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Acronis Cyber Protect versions prior to build 42587 for both Linux and Windows platforms represents a critical failure in access control mechanisms, specifically categorized under CWE-269 Improper Privilege Management or more precisely CWE-862 Missing Authorization. This flaw allows an attacker who has already authenticated to the system to bypass intended security restrictions and access sensitive data that should be restricted to higher-privileged users or isolated processes. In the context of enterprise backup and disaster recovery solutions like Acronis Cyber Protect, such a vulnerability is particularly severe because these systems often hold comprehensive snapshots of organizational infrastructure, including databases, file servers, and virtual machine states. The improper authorization logic likely stems from insufficient validation of user roles against requested resources within the application's API or administrative interface, enabling lateral movement or data exfiltration by lower-privileged accounts that should not have visibility into certain configuration details or backup metadata.
From an operational perspective, this vulnerability facilitates unauthorized disclosure of sensitive information which can include encryption keys, authentication credentials stored for managed endpoints, network topology maps derived from agent telemetry, and potentially the contents of backed-up files if access controls on the storage backend are also compromised. Attackers leveraging this flaw could use ATT&CK technique T1078 Valid Accounts to maintain persistent access or T1530 Data from Cloud Storage Object Discovery to enumerate available backup repositories. The impact extends beyond simple data leakage; it undermines the integrity of the security posture by allowing adversaries to map out protected assets and identify potential targets for further exploitation, such as ransomware deployment against unprotected endpoints that were previously shielded by the software's monitoring capabilities.
The remediation strategy requires immediate application of vendor-supplied patches or updates to bring all affected Acronis Cyber Protect installations on Linux and Windows platforms to build 42587 or later. Organizations should verify their current build numbers through the administrative console and prioritize patching for systems that are internet-facing or manage critical infrastructure assets. In addition to software updates, administrators should review existing user role assignments within the platform to ensure adherence to the principle of least privilege, restricting access to sensitive configuration modules only to designated security operators. Regular auditing of authentication logs is also recommended to detect any anomalous access patterns that may indicate exploitation attempts prior to patching.