CVE-2026-28714: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2026-28714 is a vulnerability involving the unnecessary transmission of sensitive cryptographic material in Acronis Cyber Protect 17, classified under CWE-522 (Insufficiently Protected Credentials). It affects Acronis Cyber Protect 17 on both Linux and Windows platforms prior to build 41186. The vulnerability was published on March 6, 2026, with a patch made available shortly after. It carries a CVSS v3.0 base score of 4.8 (Medium) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials), where the application unnecessarily transmits sensitive cryptographic material over the network without adequate protection. The attack vector is adjacent network (AV:A), meaning an attacker must be on the same network segment as the victim. Exploitation requires high attack complexity and user interaction, limiting the practical attack surface. No public technical write-ups or proof-of-concept code have been identified (Acronis Advisory).

Successful exploitation could allow an adjacent network attacker to intercept sensitive cryptographic credentials during transmission, resulting in a high confidentiality impact. Captured cryptographic material could potentially be leveraged for unauthorized access to affected systems, with associated attack patterns including session sidejacking, pass-the-hash, and credential stuffing. There is no expected impact to system integrity or availability — only the confidentiality of cryptographic material is at risk (Acronis Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Acronis Advisory).

Acronis has released a patch in Cyber Protect 17 build 41186 for both Linux and Windows. Organizations should prioritize upgrading to build 41186 or later as the primary remediation step. As interim mitigations, implement network segmentation to restrict adjacent network access to systems running affected versions, monitor network traffic for anomalous credential transmission patterns, and limit user interactions with the application until patching is complete (Acronis Advisory).