CVE-2026-87880 in Cyber Protect
Summary
by MITRE • 10/28/2026
Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability described constitutes a critical flaw in the transport layer security implementation of specific components within Acronis Cyber Protect versions prior to build 42587 for both Linux and Windows platforms. This issue stems from an incomplete or missing verification process regarding Secure Sockets Layer certificates during communication between client agents and management servers or cloud services. In standard secure communications, SSL certificate validation ensures that the entity at the other end of a connection is who it claims to be by verifying its digital signature against trusted root authorities. When this verification step is omitted or improperly configured in one component, the system fails to authenticate the identity of the remote server before establishing an encrypted channel. This oversight creates a significant gap in the defense-in-depth strategy typically employed by enterprise backup and security solutions, leaving the integrity and confidentiality of data transmissions vulnerable to interception and manipulation.
From a technical perspective, this flaw aligns with Common Weakness Enumeration category CWE-295, which addresses Improper Certificate Validation. The absence of strict certificate pinning or validation allows for potential man-in-the-middle attacks where an adversary could intercept network traffic between the Acronis agent and its backend infrastructure. By positioning themselves as a proxy, attackers can decrypt sensitive backup data, configuration files, and authentication credentials that are transmitted over these connections. Furthermore, this weakness facilitates session hijacking scenarios where active sessions can be taken over by impersonating the legitimate server. The impact is particularly severe in enterprise environments where Acronis Cyber Protect manages large-scale deployments across hybrid cloud and on-premises infrastructure, as a single compromised component could potentially expose data from multiple endpoints if the trust model relies heavily on this unverified connection path.
The operational impact of this vulnerability extends beyond simple data leakage to include potential compromise of system integrity and availability. An attacker exploiting this flaw could inject malicious code into backup streams or modify configuration settings remotely, leading to corrupted backups that cannot be restored during a disaster recovery event. This directly undermines the core value proposition of cyber protection software by rendering safety mechanisms ineffective. Additionally, if authentication tokens are intercepted due to lack of mutual TLS verification, attackers may gain unauthorized administrative access to the management console, allowing them to disable security features on protected endpoints or exfiltrate sensitive organizational data at scale. The risk is amplified in environments where network segmentation policies assume that internal traffic between agents and servers is inherently trusted without rigorous cryptographic validation.
To mitigate this vulnerability, organizations must prioritize immediate patching of all affected Acronis Cyber Protect installations to build 42587 or later versions released by the vendor. This update includes the necessary code changes to enforce strict SSL certificate verification across all communication channels involving the vulnerable component. In addition to applying patches, security teams should audit their network configurations to ensure that no legacy systems are relying on insecure protocols for agent-server communication. Implementing additional monitoring using intrusion detection systems can help identify anomalous traffic patterns indicative of man-in-the-middle attempts targeting backup infrastructure. It is also advisable to review certificate management policies to ensure that internal Certificate Authorities used for mutual TLS authentication are properly configured and trusted by all endpoints, thereby closing the gap exploited by this flaw.
This incident highlights the importance of adhering to secure coding practices regarding cryptographic implementations as outlined in industry standards such as OWASP Transport Layer Protection Cheat Sheet. The failure to validate certificates represents a fundamental breakdown in establishing trust boundaries within distributed systems. Security architects should conduct regular assessments of their backup and management infrastructure to identify similar weaknesses where certificate validation might be bypassed for convenience or due to legacy configuration drift. By treating SSL verification not as an optional feature but as a mandatory control, organizations can significantly reduce the attack surface associated with data transmission vulnerabilities in critical enterprise software suites like Acronis Cyber Protect.