CVE-2025-30413: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2025-30413 is a credential persistence vulnerability in Acronis Agent where credentials are not deleted after plan revocation. It affects Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497 and Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186. The vulnerability was published on March 6, 2026, with a patch advisory available from Acronis. It carries a CVSS v3.1 base score of 4.4 (Medium) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), where the Acronis Agent fails to securely delete stored credentials when a backup or protection plan is revoked. The attack vector is local, requiring high privileges on the affected system, meaning an attacker must already have administrative or elevated access to exploit the residual credentials. No network-based exploitation is possible, and there are no known public proof-of-concept exploits or technical write-ups detailing the precise storage location or format of the retained credentials (Acronis Advisory, Red Hat CVE).

A high-privilege local attacker can access sensitive credentials that persist in the Acronis Agent after a protection plan has been revoked, potentially enabling unauthorized access to systems or resources that were previously protected under that plan. The impact is limited to confidentiality — there is no integrity or availability impact. Lateral movement is a secondary risk if the exposed credentials grant access to additional systems or cloud environments managed by the revoked plan (Acronis Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high local privileges, significantly limiting the attacker pool (Acronis Advisory, Red Hat CVE).

Acronis has released patches addressing this vulnerability. Administrators should upgrade Acronis Cyber Protect Cloud Agent to build 40497 or later, and Acronis Cyber Protect 17 to build 41186 or later. As compensating controls prior to patching, organizations should restrict high-privilege local access on systems running vulnerable versions and monitor for unauthorized credential access attempts. Implementing credential management controls and secure deletion procedures can further reduce risk (Acronis Advisory).