CVE-2025-11791: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2025-11791 is a missing authorization vulnerability in Acronis Cyber Protect 17 and Acronis Cyber Protect Cloud Agent that allows low-privileged local users to disclose and manipulate sensitive information. It affects Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186 and Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124. The vulnerability was published on March 6, 2026, with a patch made available around the same time. It carries a CVSS v3.1 base score of 7.1 (High) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) — the affected products fail to perform sufficient authorization checks before granting access to sensitive operations or data. The attack vector is local, requiring low privileges and no user interaction, with low attack complexity. An authenticated local user can bypass access controls to read sensitive information and modify protected data within the Acronis backup and protection subsystems (Acronis Advisory, Red Hat CVE). No public proof-of-concept code has been identified.

Successful exploitation allows a low-privileged local attacker to access sensitive information (high confidentiality impact) and manipulate protected data (high integrity impact) without any user interaction. Availability is not affected. The vulnerability poses risk to backup configurations, credentials, and protected data managed by Acronis Cyber Protect across Linux, macOS, and Windows environments, potentially enabling unauthorized modification of backup policies or exfiltration of sensitive backup data (Acronis Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Acronis Advisory, Red Hat CVE).

Acronis has released patches addressing this vulnerability. Users should update to Acronis Cyber Protect 17 build 41186 or later, and Acronis Cyber Protect Cloud Agent build 41124 or later, across all supported platforms (Linux, macOS, Windows). As interim mitigations, administrators should restrict local user privileges to the minimum necessary, limit local access to Acronis-managed systems to trusted users only, and monitor for unauthorized access to sensitive data or unexpected modifications to backup configurations (Acronis Advisory).