CVE-2025-30412: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2025-30412 is a critical improper authentication vulnerability in Acronis Cyber Protect that enables unauthenticated remote attackers to disclose and manipulate sensitive data. It affects Acronis Cyber Protect 16 (Linux, Windows) before build 39938 and Acronis Cyber Protect 15 (Linux, Windows) before build 41800. The vulnerability was published on February 20, 2026, with a patch advisory released by Acronis. It carries a CVSS v3.0 base score of 10.0 (Critical) (Acronis Advisory, Red Hat CVE).

The root cause is improper authentication (CWE-287), where the affected Acronis Cyber Protect components fail to adequately verify the identity of requestors before granting access to sensitive operations. The attack vector is network-based, requires no privileges and no user interaction, and has low attack complexity — making it trivially exploitable by any unauthenticated remote attacker. The vulnerability's changed scope indicates that a successful exploit can impact resources beyond the directly vulnerable component, such as backup data stores, system configurations, and managed endpoints (Acronis Advisory, Red Hat CVE).

Successful exploitation allows an unauthenticated attacker to disclose sensitive data (confidentiality impact: HIGH), manipulate data integrity (integrity impact: HIGH), and potentially cause denial of service (availability impact: HIGH). Because the scope is changed, the attacker may be able to affect resources beyond the Cyber Protect management component itself, including backup archives, protected endpoint data, and critical system configurations. This could facilitate unauthorized access to business-critical backup data and enable further lateral movement within the protected environment (Acronis Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Acronis Advisory). The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the CVSS 10.0 score and zero-authentication requirement make it a high-priority target if exploitation techniques become public.

Acronis has released patches addressing this vulnerability. Organizations should update Acronis Cyber Protect 16 to build 39938 or later, and Acronis Cyber Protect 15 to build 41800 or later, on both Linux and Windows deployments. Given the critical CVSS 10.0 score and zero-authentication requirement, patching should be treated as an urgent priority. As an interim measure, restricting network access to the Cyber Protect management interface to trusted IP ranges can reduce exposure until patching is complete (Acronis Advisory).

The vulnerability received coverage from security news outlets including Heise and The Hacker Wire, which highlighted the critical severity of the flaw alongside other Acronis Cyber Protect vulnerabilities disclosed around the same time (Heise, The Hacker Wire). Community forums such as MalwareTips also discussed the risk to Linux and Windows systems. No significant public researcher commentary or vendor statements beyond the official advisory have been identified.