Cyber Protect vulnerabilities

38 known vulnerabilities in Cyber Protect from Acronis. 38 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Acronis Cyber Protect 17: Incorrect Default Permissions

  CVE-2026-28727Mar 6, 2026Acronis

  Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124, Acronis True Image (macOS) before build

• 7.3 High severity

  Acronis Cyber Protect 17: Externally Controlled Reference to a Resource in Another Sphere

  CVE-2026-28722Mar 6, 2026Acronis

  Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

• 7.3 High severity

  Acronis Cyber Protect 17: Externally Controlled Reference to a Resource in Another Sphere

  CVE-2026-28721Mar 6, 2026Acronis

  Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

• 7.5 High severity

  Acronis Cyber Protect 17: Logging of Excessive Data

  CVE-2026-28718Mar 6, 2026Acronis

  Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

• 7.1 High severity

  Acronis Cyber Protect Cloud Agent: Use of Default Credentials

  CVE-2026-28713Mar 6, 2026Acronis

  Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.

• 9.8 Critical severity

  Acronis Cyber Protect 17: Weak Authentication

  CVE-2026-28710Mar 6, 2026Acronis

  Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

• 7.1 High severity

  Acronis Cyber Protect 17: Missing Authorization

  CVE-2025-11791Mar 6, 2026Acronis

  Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186, Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) befo

• 10.0 Critical severity

  Acronis Cyber Protect 16: Missing Authorization

  CVE-2025-30416Feb 20, 2026Acronis

  Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

• 10.0 Critical severity

  Acronis Cyber Protect 16: Weak Authentication

  CVE-2025-30412Feb 20, 2026Acronis

  Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

• 10.0 Critical severity

  Acronis Cyber Protect 16: Weak Authentication

  CVE-2025-30411Feb 20, 2026Acronis

  Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

• 7.8 High severity

  Acronis Cyber Protect 16: Uncontrolled Search Path Element

  CVE-2024-55543Jan 2, 2025Acronis

  Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.

• 7.8 High severity

  Acronis Cyber Protect 16: Uncontrolled Search Path Element

  CVE-2024-55540Jan 2, 2025Acronis

  Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.

• 9.1 Critical severity

  Acronis Cyber Protect 16: Authorization Bypass Through User-Controlled Key

  CVE-2024-49388Oct 15, 2024Acronis

  Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.

• 7.5 High severity

  Acronis Cyber Protect 16: Cleartext Transmission of Sensitive Information

  CVE-2024-49387Oct 15, 2024Acronis

  Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.

• 9.1 Critical severity

  Acronis Cyber Protect 15: Authorization Bypass Through User-Controlled Key

  CVE-2023-44206Sep 27, 2023AcronisEPSS 1.03%

  Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

• 7.5 High severity

  Acronis Cyber Protect 15: Cleartext Storage of Sensitive Information

  CVE-2023-44159Sep 27, 2023Acronis

  Sensitive information disclosure due to cleartext storage of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

• 7.5 High severity

  Acronis Cyber Protect 15: Insufficiently Protected Credentials

  CVE-2023-44158Sep 27, 2023Acronis

  Sensitive information disclosure due to insufficient token field masking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

• 7.8 High severity

  Acronis Cyber Protect 15: Incorrect Default Permissions

  CVE-2023-44157Sep 27, 2023Acronis

  Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 35979.

• 7.5 High severity

  Acronis Cyber Protect 15: Exposure of Private Personal Information to an Unauthorized Actor

  CVE-2023-44156Sep 27, 2023AcronisEPSS 1.04%

  Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

• 8.1 High severity

  Acronis Cyber Protect 15: Authorization Bypass Through User-Controlled Key

  CVE-2023-44154Sep 27, 2023Acronis

  Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979.

• 7.5 High severity

  Acronis Cyber Protect 15: Cleartext Storage of Sensitive Information

  CVE-2023-44153Sep 27, 2023Acronis

  Sensitive information disclosure due to cleartext storage of sensitive information in memory. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

• 9.1 Critical severity

  Acronis Cyber Protect 15: Improper Authentication

  CVE-2023-44152Sep 27, 2023Acronis

  Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

• 7.5 High severity

  Acronis Agent: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-41749Aug 31, 2023Acronis

  Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Agent (Windows) before build 32047, Acronis Cyber Protect 15 (Windows) before build 35979.

• 7.8 High severity

  Acronis Agent: Improper Verification of Cryptographic Signature

  CVE-2023-41744Aug 31, 2023Acronis

  Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Agent (macOS) before build 30600, Acronis Cyber Protect 15 (macOS) before build 35979.

• 7.8 High severity

  Acronis Cyber Protect Home Office: Improper Privilege Management

  CVE-2023-41743Aug 31, 2023Acronis

  Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278, Acronis Cyber Protect Cloud Agent (Windows) before build 31637, Acronis Cyber

• 7.5 High severity

  Acronis Agent: Exposure of Resource to Wrong Sphere

  CVE-2023-41742Aug 31, 2023Acronis

  Excessive attack surface due to binding to an unrestricted IP address. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 30430, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 35979.

• 7.8 High severity

  Acronis Cyber Protect Home Office: Improper Privilege Management

  CVE-2022-45451Aug 31, 2023Acronis

  Local privilege escalation due to insecure driver communication port permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173, Acronis Agent (Windows) before build 30600, Acronis Cyber Protect 15 (Windows

• 7.5 High severity

  Acronis Agent: Incorrect Default Permissions

  CVE-2022-45459May 18, 2023Acronis

  Sensitive information disclosure due to insecure registry permissions. The following products are affected: Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984.

• 7.5 High severity

  Acronis Agent: Improper Certificate Validation

  CVE-2022-45458May 18, 2023Acronis

  Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 29633, Acronis Cyber Protect 15 (Windows, macOS, Linux) before build 30984.

• 7.5 High severity

  Acronis Agent: Improper Certificate Validation

  CVE-2022-45457May 18, 2023Acronis

  Sensitive information disclosure and manipulation due to improper certification validation. The following products are affected: Acronis Agent (Windows) before build 29633, Acronis Cyber Protect 15 (Windows) before build 30984.

• 7.8 High severity

  Acronis Agent: Incorrect Default Permissions

  CVE-2022-45452May 18, 2023Acronis

  Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30430, Acronis Cyber Protect 15 (Windows) before build 30984.

• 7.5 High severity

  Acronis Agent: Files or Directories Accessible to External Parties

  CVE-2022-45450May 18, 2023Acronis

  Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 28610, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 30984.

• 8.8 High severity

  Acronis Cyber Protect 15: Improper Privilege Management

  CVE-2022-3405May 3, 2023AcronisEPSS 5.33%

  Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before buil

• 7.5 High severity

  Acronis Cyber Protect 15: Improper Authentication

  CVE-2022-30995May 3, 2023AcronisEPSS 3.26%

  Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545.

• 7.8 High severity

  Acronis Cyber Protect Home Office: Incomplete Cleanup

  CVE-2022-45455Feb 13, 2023Acronis

  Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before buil

• 7.5 High severity

  Acronis Agent: Incorrect Default Permissions

  CVE-2022-45454Feb 13, 2023Acronis

  Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis Cyber Protect 15 (Windows) before build 30984.

• 7.5 High severity

  Acronis Cyber Protect 15: Incorrect Permission Assignment for Critical Resource

  CVE-2022-30990May 18, 2022Acronis

  Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Linux) before build 29240, Acronis Agent (Linux) before build 28037

• 7.8 High severity

  Acronis Cyber Protect 15: Incorrect Default Permissions

  CVE-2022-24113Feb 4, 2022Acronis

  Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Wind