CVE-2026-28723: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2026-28723 is an incorrect authorization vulnerability in Acronis Cyber Protect 17 that allows authenticated low-privileged users to delete reports without proper authorization. It affects Acronis Cyber Protect 17 on both Linux and Windows platforms prior to build 41186. The vulnerability was published on March 6, 2026, with a patch made available by March 13, 2026. It carries a CVSS v3.0 base score of 4.3 (Medium) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization) — the application fails to perform adequate authorization checks before allowing report deletion operations, permitting users to act beyond their intended access scope (Acronis Advisory). The attack vector is network-based, requires low privileges (an authenticated account), low attack complexity, and no user interaction. No public proof-of-concept or detailed technical write-up has been identified at this time (Feedly).

Successful exploitation allows authenticated low-privileged users to delete reports they are not authorized to remove, resulting in a low integrity impact with no confidentiality or availability impact. The primary risk is the ability to tamper with audit trails and compliance records, potentially obstructing forensic investigations or regulatory audits. Attackers could leverage this to cover tracks by removing evidence of malicious activity within the Acronis Cyber Protect environment (Acronis Advisory, Feedly).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2026-28723. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Feedly, Acronis Advisory).

Acronis has released a patch in Acronis Cyber Protect 17 build 41186 (available as of March 13, 2026); organizations should upgrade all affected Linux and Windows installations to this build or later immediately (Acronis Advisory). As interim measures, administrators should review and restrict report deletion permissions to only authorized personnel, audit recent report deletion activity for anomalies, and implement network segmentation to limit access to Acronis Cyber Protect management interfaces to trusted users only.