This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Acronis fixes 24 vulnerabilities
Acronis fixes 24 vulnerabilities in Acronis Cyber Protect 17 and Acronis Cyber Protect Cloud Agent. The most severe vulnerabilities are described below; the remaining ones can be found at [1] by clicking through the individual advisories. The fixed versions can be found in the links next to each vulnerability.
Allows an unauthenticated remote attacker to obtain and manipulate sensitive information due to insufficient authentication in Acronis Cyber Protect 17 [2].
The vulnerability is present in product:
- Acronis Cyber Protect 17 (Linux, Windows); < build 41186
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-28710 at cve.org, NVD
- CWE-1390: Weak Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2026.
Allows an authenticated local attacker to escalate their privileges due to insecure Unix socket permissions in Acronis Cyber Protect 17 and Acronis Cyber Protect Cloud Agent [3]
The vulnerability is present in products:
- Acronis Cyber Protect 17 (macOS); < build 41186
- Acronis Cyber Protect Cloud Agent (macOS); < build 41124
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-28727 at cve.org, NVD
- CWE-276: Incorrect Default Permissions at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2026.
Allows an authenticated local attacker to escalate their privileges due to improper handling of symbolic links in Acronis Cyber Protect 17 [4][5].
The vulnerability is present in product:
- Acronis Cyber Protect 17 (Windows); < build 41186
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-28721 at cve.org, NVD
- CVE-2026-28722 at cve.org, NVD
- CWE-610: Externally Controlled Reference to a Resource in Another Sphere at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2026.
Allows an authenticated local attacker to escalate their privileges due to a DLL hijacking vulnerability in Acronis Cyber Protect Cloud Agent [6].
The vulnerability is present in product:
- Acronis Cyber Protect Cloud Agent (Windows); < build 41124
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-11792 at cve.org, NVD
- CWE-427: Uncontrolled Search Path Element at cwe.mitre.org
The vulnerability was publicly disclosed 5. 3. 2026.
Links
- [1] https://security-advisory.acronis.com/advisories?page=1&sort=-published%20-cvss%20-id
- [2] https://security-advisory.acronis.com/advisories/SEC-9137
- [3] https://security-advisory.acronis.com/advisories/SEC-9408
- [4] https://security-advisory.acronis.com/advisories/SEC-8445
- [5] https://security-advisory.acronis.com/advisories/SEC-8481
- [6] https://security-advisory.acronis.com/advisories/SEC-9439
By CESNET, z.s.p.o. Michaela Jarošová on 9. 3. 2026.