CVE-2026-28714: Acronis Cyber Protect Info Disclosure

CVE-2026-28714 Overview

CVE-2026-28714 is an information disclosure vulnerability in Acronis Cyber Protect 17 for Linux and Windows. The flaw involves the unnecessary transmission of sensitive cryptographic material over the network. An attacker with adjacent network access can intercept this material when a user performs a required action. The vulnerability is classified under CWE-522: Insufficiently Protected Credentials. Acronis addressed the issue in build 41186. The weakness affects confidentiality but does not impact integrity or availability of the host system.

Critical Impact

Cryptographic material exposed on adjacent networks can enable attackers to compromise protected backups and authenticated sessions tied to Acronis Cyber Protect 17.

Affected Products

• Acronis Cyber Protect 17 for Linux (before build 41186)
• Acronis Cyber Protect 17 for Windows (before build 41186)
• Deployments running on Linux kernel and Microsoft Windows host operating systems

Discovery Timeline

• 2026-03-06 - CVE-2026-28714 published to NVD
• 2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-28714

Vulnerability Analysis

The vulnerability stems from Acronis Cyber Protect 17 transmitting cryptographic material that should not leave the host or should be protected by additional layers. This material can include secrets used to authenticate sessions, protect backups, or encrypt data in transit. Because the transmission is unnecessary, the design itself creates the exposure rather than a single coding defect.

Exploitation requires adjacent network positioning, high attack complexity, and user interaction. An attacker must be on the same logical network segment as the target. The attacker must also wait for or induce conditions where a user triggers the affected workflow. Successful interception yields high confidentiality impact without modifying or disrupting the target.

Root Cause

The root cause maps to CWE-522: Insufficiently Protected Credentials. Acronis Cyber Protect 17 sends cryptographic material across the network when it is not required by the operation. Sensitive secrets that should remain local are instead exposed to anyone with visibility into the adjacent network path.

Attack Vector

An attacker positioned on the adjacent network observes traffic between the Acronis Cyber Protect 17 agent and its management or storage endpoints. When a user initiates the affected operation, the cryptographic material crosses the wire. The attacker captures the material using passive sniffing or active interception techniques. No verified public proof-of-concept exists at this time. Refer to the Acronis Security Advisory SEC-5383 for vendor-confirmed technical detail.

Detection Methods for CVE-2026-28714

Indicators of Compromise

• Acronis Cyber Protect 17 agent versions reporting builds earlier than 41186 on Linux or Windows hosts.
• Unexpected promiscuous-mode interfaces or packet capture utilities running on systems sharing a subnet with Acronis agents.
• Anomalous authentication events or backup access from endpoints that did not originate the legitimate workflow.

Detection Strategies

• Inventory all Acronis Cyber Protect 17 installations and compare build numbers against 41186 to identify exposed hosts.
• Monitor network segments hosting Acronis agents for ARP spoofing, rogue DHCP, and other adjacent-network attack precursors.
• Correlate Acronis agent activity with downstream authentication events to detect credential reuse from unexpected sources.

Monitoring Recommendations

• Centralize Acronis Cyber Protect agent and management logs into a SIEM and alert on configuration changes or new agent registrations.
• Capture NetFlow or full packet metadata on segments carrying Acronis traffic to support retrospective investigation.
• Track user-initiated backup, restore, and console operations to identify the workflows that trigger sensitive transmissions.

How to Mitigate CVE-2026-28714

Immediate Actions Required

• Upgrade Acronis Cyber Protect 17 to build 41186 or later on all Linux and Windows hosts.
• Rotate any credentials, encryption keys, or tokens that may have been transmitted by vulnerable builds.
• Restrict Acronis management and agent traffic to trusted, segmented networks pending patch deployment.

Patch Information

Acronis released the fix in Acronis Cyber Protect 17 build 41186. Apply the update on every affected Linux and Windows endpoint. Verify remediation by confirming the build number after installation. Full vendor guidance is available in the Acronis Security Advisory SEC-5383.

Workarounds

• Place Acronis Cyber Protect 17 agents and management servers on isolated VLANs with strict access control lists.
• Require IPsec or equivalent network-layer encryption between agents and management or storage endpoints.
• Enforce port security, dynamic ARP inspection, and DHCP snooping to limit adjacent-network attacker positioning.

# Configuration example
# Verify the installed Acronis Cyber Protect build on Linux
rpm -qa | grep -i acronis
# Or on Debian-based systems
dpkg -l | grep -i acronis

# Verify the installed build on Windows (PowerShell)
Get-ItemProperty 'HKLM:\SOFTWARE\Acronis\*' | Select-Object DisplayName, DisplayVersion