CVE-2026-28724: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2026-28724 is an incorrect authorization vulnerability in Acronis Cyber Protect 17 that allows low-privileged authenticated attackers to access data they are not authorized to read. The flaw stems from insufficient access control validation and affects Acronis Cyber Protect 17 on both Linux and Windows platforms before build 41186. It was published on March 6, 2026, with a patch made available around March 13, 2026. The vulnerability carries a CVSS v3.0 base score of 4.3 (Medium) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization), meaning the application fails to properly validate whether an authenticated user has the appropriate permissions before granting access to certain data. An attacker with low-level network access and valid credentials can exploit this flaw by making network requests to access data beyond their authorization scope, without requiring any user interaction or elevated privileges. No public technical write-ups or proof-of-concept code have been identified for this vulnerability (Acronis Advisory).

Successful exploitation results in unauthorized read access to sensitive data within Acronis Cyber Protect 17, impacting confidentiality. There is no impact to data integrity or system availability. Because Acronis Cyber Protect handles backup and endpoint protection data, unauthorized access could expose sensitive organizational information such as backup configurations, protected system details, or credentials stored within the platform (Acronis Advisory).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated network access with low privileges, which somewhat limits the attack surface (Acronis Advisory).

Acronis has released a patch in Acronis Cyber Protect 17 build 41186 for both Linux and Windows. Organizations should prioritize upgrading to build 41186 or later as the primary remediation step. As interim measures, restrict network access to Acronis Cyber Protect 17 services to trusted networks, implement network segmentation to limit exposure, apply the principle of least privilege to user accounts, and review access logs for anomalous data access attempts by low-privileged accounts (Acronis Advisory).