Acronis vulnerabilities
We track 92 vulnerabilities in Acronis products across 34 products. 92 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 28, 2026.
Latest Acronis vulnerabilities
- 7.4 High severity
Acronis Cyber Protect 17: Improper Verification of Cryptographic Signature
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
- 7.4 High severity
Acronis Cyber Protect 17: Improper Verification of Cryptographic Signature
Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
- 7.1 High severity
Acronis Cyber Protect Cloud Agent: Weak Authentication
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
- 9.1 Critical severity
Acronis Cyber Infrastructure: Incorrect Authorization
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infr
- 7.8 High severity
Acronis Backup Incorrect Default Permissions Exploited
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin
- 7.3 High severity
Acronis DeviceLock DLP: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
- 7.3 High severity
Acronis DeviceLock DLP: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
- 7.3 High severity
Acronis DeviceLock DLP: Uncontrolled Search Path Element
Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
- 7.3 High severity
Acronis DeviceLock DLP: Execution with Unnecessary Privileges
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
- 7.8 High severity
Acronis DeviceLock DLP: Write-what-where Condition
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
- 7.8 High severity
Acronis DeviceLock DLP: Out-of-bounds Write
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
- 7.8 High severity
Acronis True Image OEM: External Control of System or Configuration Setting
Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.
- 7.8 High severity
Acronis Cyber Protect 17: Incorrect Default Permissions
Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124, Acronis True Image (macOS) before build
- 7.3 High severity
Acronis Cyber Protect 17: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
- 7.3 High severity
Acronis Cyber Protect 17: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
- 7.5 High severity
Acronis Cyber Protect 17: Logging of Excessive Data
Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
- 7.1 High severity
Acronis Cyber Protect Cloud Agent: Use of Default Credentials
Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.
- 9.8 Critical severity
Acronis Cyber Protect 17: Weak Authentication
Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
- 7.3 High severity
Acronis Cyber Protect Cloud Agent: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124.
- 7.1 High severity
Acronis Cyber Protect 17: Missing Authorization
Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186, Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) befo
- 10.0 Critical severity
Acronis Cyber Protect 16: Missing Authorization
Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
- 10.0 Critical severity
Acronis Cyber Protect 16: Weak Authentication
Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
- 10.0 Critical severity
Acronis Cyber Protect 16: Weak Authentication
Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
- 9.8 Critical severity
Acronis Cyber Protect Cloud Agent: Missing Authentication for Critical Functionality
Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Ac
- 8.8 High severity
Acronis True Image: Improper Privilege Management
Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) before build 42389, Acronis True Image for SanDisk (macOS) before build 42198, Acronis True Image for Western Digital (macOS)
- 7.3 High severity
Acronis True Image: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) b
- 7.8 High severity
Acronis Cyber Protect Cloud Agent: Incorrect Permission Assignment for Critical Resource
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40734.
- 7.3 High severity
Acronis Cyber Protect Cloud Agent: Externally Controlled Reference to a Resource in Another Sphere
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.
- 7.3 High severity
Acronis Cyber Protect 16: Incorrect Permission Assignment for Critical Resource
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938.
- 7.5 High severity
Acronis Cyber Protect Cloud Agent: Improper Validation of Syntactic Correctness of Input
Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40077, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
- 7.8 High severity
Acronis Cyber Protect 16: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
- 7.8 High severity
Acronis Cyber Protect 16: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
- 7.3 High severity
Acronis Cyber Files: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
- 7.3 High severity
Acronis Cyber Files: Uncontrolled Search Path Element
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
- 7.8 High severity
Acronis Cyber Files: Incorrect Default Permissions
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
- 9.1 Critical severity
Acronis Cyber Protect 16: Authorization Bypass Through User-Controlled Key
Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
- 7.5 High severity
Acronis Cyber Protect 16: Cleartext Transmission of Sensitive Information
Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
- 9.9 Critical severity
Acronis Backup plugin for cPanel & WHM: Execution with Unnecessary Privileges
Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Back
- 9.8 Critical severity
Acronis Cyber Infrastructure (ACI) Insecure Default Password Exploited
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5
- 7.8 High severity
Acronis True Image: Improper Neutralization of Special Elements used in an OS Command
Local privilege escalation due to OS command injection vulnerability. The following products are affected: Acronis True Image (macOS) before build 41396, Acronis True Image OEM (macOS) before build 42571.