CVE-2026-28716: Acronis Cyber Protect Auth Bypass Flaw

CVE-2026-28716 Overview

CVE-2026-28716 is an improper authorization vulnerability (CWE-863) affecting Acronis Cyber Protect 17 on both Linux and Windows platforms. The vulnerability enables information disclosure and data manipulation due to insufficient authorization checks within the application, allowing authenticated local users to access or modify data beyond their intended permissions.

Critical Impact

Local attackers with low privileges can exploit improper authorization checks to disclose sensitive information and manipulate data within Acronis Cyber Protect 17 environments.

Affected Products

• Acronis Cyber Protect 17 (Linux) before build 41186
• Acronis Cyber Protect 17 (Windows) before build 41186

Discovery Timeline

• 2026-03-06 - CVE-2026-28716 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-28716

Vulnerability Analysis

This vulnerability stems from improper authorization checks (CWE-863) within Acronis Cyber Protect 17. The flaw allows authenticated local users to bypass intended access restrictions, resulting in unauthorized information disclosure and the ability to manipulate protected data. The attack requires local access and low-level privileges, but does not require user interaction to exploit.

The vulnerability affects both the confidentiality and integrity of the system, though availability remains unaffected. Attackers who successfully exploit this vulnerability can read sensitive configuration data, backup metadata, or other protected information, and potentially modify settings or data they should not have access to.

Root Cause

The root cause is insufficient authorization verification when handling user requests within Acronis Cyber Protect 17. The application fails to properly validate whether a user has appropriate permissions before granting access to certain resources or allowing specific operations. This broken access control pattern allows users to access functionality or data outside their authorized scope.

Attack Vector

The attack vector is local, requiring the attacker to have existing authenticated access to the system running Acronis Cyber Protect 17. An attacker with low-level privileges can exploit the improper authorization checks to:

1. Access sensitive information belonging to other users or the system
2. Modify configuration settings or data they should not have write access to
3. Potentially escalate their access to more sensitive backup or protection data

The exploitation does not require any user interaction, making it easier for attackers to leverage once they have local system access.

Detection Methods for CVE-2026-28716

Indicators of Compromise

• Unexpected access patterns to Acronis Cyber Protect configuration files or backup metadata from low-privileged accounts
• Anomalous modifications to protection settings or backup configurations by unauthorized users
• Audit log entries showing access to protected resources by users without appropriate permissions

Detection Strategies

• Monitor Acronis Cyber Protect application logs for authorization failures followed by successful access attempts
• Implement file integrity monitoring on critical Acronis Cyber Protect configuration directories
• Review system access logs for unusual local user activity targeting Acronis services or data stores

Monitoring Recommendations

• Enable detailed audit logging within Acronis Cyber Protect 17 to track all access requests and authorization decisions
• Configure SIEM rules to alert on patterns indicative of authorization bypass attempts
• Regularly review user permissions and access logs to identify potential exploitation attempts

How to Mitigate CVE-2026-28716

Immediate Actions Required

• Upgrade Acronis Cyber Protect 17 to build 41186 or later on all affected Linux and Windows systems
• Review and audit user permissions within Acronis Cyber Protect to ensure least-privilege principles
• Monitor systems for signs of exploitation while patching is in progress

Patch Information

Acronis has released a security update addressing this vulnerability in Acronis Cyber Protect 17 build 41186. Organizations should apply this update immediately to remediate the improper authorization vulnerability. For detailed patch information, refer to the Acronis Security Advisory SEC-3687.

Workarounds

• Restrict local system access to only trusted administrators and essential personnel until patching is complete
• Implement additional monitoring and access controls around Acronis Cyber Protect services
• Consider network segmentation to limit potential lateral movement if systems cannot be immediately patched