CVE-2026-87099 in Cyber Protect
Summary
by MITRE • 10/28/2026
Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw represents a classic Cross-Site Scripting vulnerability rooted in insufficient sanitization of user-supplied data within the Acronis Cyber Protect application interface prior to build 42587 for both Linux and Windows deployments. This type of weakness occurs when an application accepts untrusted input from users, such as form fields or URL parameters, without properly validating or encoding that data before including it in dynamic web content served back to other users. In the context of Acronis Cyber Protect, which serves as a centralized platform for managing cybersecurity operations across enterprise environments, this vulnerability allows attackers to inject malicious client-side scripts into pages viewed by legitimate administrators or operators. The core technical failure lies in the application's inability to distinguish between executable script code and benign text data during input processing, thereby bypassing standard browser security models like the same-origin policy that normally restrict how documents interact with each other.
From a classification perspective, this vulnerability aligns directly with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The absence of robust input validation mechanisms means that special characters such as angle brackets, quotes, and ampersands are not adequately escaped or encoded before being rendered in the HTML response. This oversight enables an attacker to craft a malicious payload containing JavaScript code that executes within the security context of the vulnerable application's domain. Because Acronis Cyber Protect handles sensitive operational data including backup statuses, threat intelligence feeds, and system configurations, the potential impact extends beyond simple defacement or session hijacking. An exploited vulnerability could allow for complete compromise of administrative sessions through cookie theft, enabling unauthorized access to critical infrastructure management tools without requiring authentication credentials if session tokens are stored in accessible cookies.
The operational implications of this flaw are significant given the privileged nature of users interacting with enterprise security platforms. Attackers can leverage Cross-site Scripting to perform actions on behalf of authenticated victims, such as modifying system configurations, initiating unauthorized backups or restores, or exfiltrating sensitive data displayed within the interface. Furthermore, if the application relies heavily on client-side rendering for its dashboard and reporting features, the attack surface expands considerably. The attacker could also use this vector to redirect users to phishing sites designed to steal credentials or deploy further malware onto endpoint systems managed by the platform. This creates a chain of trust violation where the integrity of the management console is compromised, potentially leading to broader network infiltration if the administrative interface provides access to other internal services or APIs that lack additional protective layers.
Mitigation strategies must focus on both immediate remediation and long-term defensive posture improvements. The primary solution involves upgrading Acronis Cyber Protect to build 42587 or later versions where this specific input validation flaw has been addressed by the vendor through enhanced encoding routines and stricter content security policies implemented at the application level. For organizations unable to immediately patch, implementing a Web Application Firewall can provide temporary protection by filtering out malicious payloads containing script tags or event handlers before they reach the vulnerable application logic. Additionally, developers should enforce strict output encoding based on the context in which data is rendered, ensuring that all user inputs are treated as data rather than executable code. Adopting Content Security Policy headers to restrict inline script execution and limiting trusted domains can further reduce the impact of any successful exploitation attempts by preventing unauthorized scripts from running even if they manage to bypass initial input checks.