CVE-2026-28726: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2026-28726 is a sensitive information disclosure vulnerability in Acronis Cyber Protect 17 caused by improper access control (incorrect authorization). It affects Acronis Cyber Protect 17 on both Linux and Windows platforms prior to build 41186. The vulnerability was published on March 6, 2026, with a patch made available on March 13, 2026. It carries a CVSS v3.0 base score of 4.3 (Medium) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-863 (Incorrect Authorization), meaning the application fails to properly enforce access restrictions on sensitive resources for authenticated users. An authenticated, low-privileged attacker can exploit this vulnerability over the network without user interaction or elevated privileges, gaining access to information that should be restricted. No specific technical write-ups or public proof-of-concept code have been identified at this time (Acronis Advisory, Red Hat CVE).

Successful exploitation allows a low-privileged authenticated attacker to disclose sensitive information over the network, with a low confidentiality impact and no effect on integrity or availability. While the scope of exposed data is not fully detailed in public advisories, unauthorized access to sensitive configuration or operational data within Acronis Cyber Protect could facilitate further attacks or expose organizational security posture. The vulnerability does not enable direct system compromise or lateral movement on its own (Acronis Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the latest available data. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Acronis Advisory, Red Hat CVE).

Acronis has released a patch in Acronis Cyber Protect 17 build 41186 (available as of March 13, 2026); organizations should upgrade immediately. As interim measures, restrict network access to the Acronis Cyber Protect 17 management interface to only authorized users and systems, and implement strict role-based access controls. Monitor authentication logs for anomalous access patterns from low-privileged accounts (Acronis Advisory).