CVE-2025-11791: Acronis Cyber Protect Info Disclosure Flaw

CVE-2025-11791 Overview

CVE-2025-11791 is a Missing Authorization vulnerability (CWE-862) affecting Acronis Cyber Protect and Acronis Cyber Protect Cloud Agent. The vulnerability enables sensitive information disclosure and manipulation due to insufficient authorization checks within the affected products. A local attacker with low privileges can exploit this flaw to manipulate sensitive data without proper authorization validation.

Critical Impact

Local attackers with low privileges can bypass authorization controls to access and manipulate sensitive information, potentially compromising data integrity across backup and protection infrastructure.

Affected Products

• Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186
• Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124

Discovery Timeline

• 2026-03-06 - CVE CVE-2025-11791 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2025-11791

Vulnerability Analysis

This vulnerability stems from Missing Authorization (CWE-862), where the affected Acronis products fail to properly validate user permissions before allowing access to sensitive operations. The local attack vector requires an authenticated user on the system, but the low complexity and no user interaction required make exploitation straightforward once local access is achieved.

The vulnerability specifically impacts data integrity rather than confidentiality or availability. An attacker can manipulate sensitive information within the Acronis Cyber Protect environment, which could compromise backup configurations, protection policies, or other critical settings managed by the affected software.

Root Cause

The root cause is insufficient authorization checks within the Acronis Cyber Protect application logic. The software fails to properly verify that a user has the necessary permissions before allowing them to perform sensitive operations. This Missing Authorization flaw (CWE-862) occurs when application code does not perform adequate access control validation, allowing users to access functionality or data beyond their intended privilege level.

Attack Vector

The attack requires local access to a system running vulnerable versions of Acronis Cyber Protect or Acronis Cyber Protect Cloud Agent. An attacker with low-level privileges on the local system can exploit the insufficient authorization checks to manipulate sensitive information.

The exploitation path involves:

1. Gaining local access to a system with a vulnerable Acronis product installed
2. Authenticating with low-privilege credentials
3. Accessing sensitive functions or data that should require higher authorization levels
4. Manipulating protected information without proper validation

For detailed technical information about this vulnerability, refer to the Acronis Security Advisory SEC-9405.

Detection Methods for CVE-2025-11791

Indicators of Compromise

• Unexpected modifications to Acronis Cyber Protect configuration files or settings
• Unauthorized access attempts to sensitive Acronis backup or protection data from low-privileged user accounts
• Anomalous API calls or function invocations within Acronis services that bypass normal authorization flows
• Audit log entries showing sensitive operations performed by users without appropriate permissions

Detection Strategies

• Monitor Acronis Cyber Protect logs for authorization failures followed by successful sensitive data access from the same user context
• Implement file integrity monitoring on Acronis configuration directories and sensitive data stores
• Deploy endpoint detection rules to alert on unusual process behavior from Acronis services
• Review audit logs for patterns of low-privileged users accessing high-privilege functionality

Monitoring Recommendations

• Enable verbose logging within Acronis Cyber Protect to capture authorization events
• Configure SIEM correlation rules to detect authorization bypass patterns specific to Acronis products
• Implement baseline monitoring for normal Acronis service behavior to identify anomalous access patterns
• Regularly audit user permissions and access logs within Acronis management consoles

How to Mitigate CVE-2025-11791

Immediate Actions Required

• Update Acronis Cyber Protect 17 to build 41186 or later immediately
• Update Acronis Cyber Protect Cloud Agent to build 41124 or later on all platforms (Linux, macOS, Windows)
• Audit existing user permissions and remove unnecessary local access to systems running Acronis products
• Review recent access logs for signs of exploitation prior to patching

Patch Information

Acronis has released patched versions that address the insufficient authorization checks:

• Acronis Cyber Protect 17: Update to build 41186 or later
• Acronis Cyber Protect Cloud Agent: Update to build 41124 or later

For complete patch details and download information, see the Acronis Security Advisory SEC-9405.

Workarounds

• Restrict local access to systems running Acronis Cyber Protect to only trusted administrators until patches can be applied
• Implement additional access controls at the operating system level to limit which users can interact with Acronis services
• Enable enhanced logging and monitoring to detect potential exploitation attempts while awaiting patch deployment
• Consider network segmentation to isolate backup infrastructure from general user access

# Verify Acronis Cyber Protect build version on Windows
# Check installed version against patched build numbers
wmic product where "name like '%Acronis Cyber Protect%'" get name,version

# On Linux, check installed package version
rpm -qa | grep -i acronis
# or
dpkg -l | grep -i acronis