CVE-2026-28725: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2026-28725 is a sensitive information disclosure vulnerability in Acronis Cyber Protect 17 caused by improper configuration of a headless browser component. It affects Acronis Cyber Protect 17 on both Linux and Windows platforms prior to build 41186. The vulnerability was published on March 6, 2026, with a patch made available by March 13, 2026. It carries a CVSS v3.0 base score of 5.5 (Medium) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), stemming from a misconfigured headless browser within the Acronis Cyber Protect 17 application. The attack vector is local, requiring low privileges and valid credentials, with no user interaction needed. A locally authenticated attacker can leverage the misconfigured headless browser to access sensitive data it processes or stores, bypassing expected access controls (Acronis Advisory, Red Hat CVE).

Successful exploitation results in a high confidentiality impact, allowing low-privileged local users to read sensitive information processed by the headless browser component. There is no integrity or availability impact. The scope is limited to the affected system, with no evidence of lateral movement potential, but the exposed data could include credentials, session tokens, or other confidential content handled by the browser (Acronis Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been identified (Acronis Advisory, Red Hat CVE).

Acronis has released a patch in Acronis Cyber Protect 17 build 41186 for both Linux and Windows. Organizations should immediately upgrade all affected installations to build 41186 or later. As interim measures, administrators should restrict local user access on systems running vulnerable versions, limit authenticated sessions, and monitor for unusual local authentication activity or anomalous data access patterns until patching is complete (Acronis Advisory).