CVE-2026-28719: Acronis Cyber Protect Auth Bypass Flaw

CVE-2026-28719 Overview

CVE-2026-28719 is an improper authorization vulnerability (CWE-863) affecting Acronis Cyber Protect 17 on both Linux and Windows platforms. The vulnerability allows authenticated attackers to perform unauthorized resource manipulation due to improper authorization checks within the application. This flaw enables users with limited privileges to modify resources they should not have access to, potentially compromising the integrity of protected data and backup configurations.

Critical Impact

Authenticated attackers can manipulate resources beyond their authorization scope, potentially affecting backup integrity and system configurations in enterprise environments.

Affected Products

• Acronis Cyber Protect 17 (Linux) before build 41186
• Acronis Cyber Protect 17 (Windows) before build 41186

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-28719 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-28719

Vulnerability Analysis

This vulnerability stems from improper authorization checks (CWE-863) within Acronis Cyber Protect 17. The application fails to properly verify that authenticated users have the appropriate permissions before allowing them to perform actions on system resources. This broken access control condition allows low-privileged users to manipulate resources that should be restricted to administrators or other privileged accounts.

The vulnerability is exploitable over the network with low attack complexity, requiring only low-level authenticated access. While no user interaction is required to exploit this flaw, the scope is unchanged, meaning the impact is contained to the vulnerable component. The primary risk is to data integrity, as attackers can modify resources without authorization, though confidentiality and availability are not directly impacted.

Root Cause

The root cause is improper authorization logic within Acronis Cyber Protect 17's resource management functionality. The application does not adequately validate whether an authenticated user possesses the necessary permissions to perform requested operations on protected resources. This implementation gap in the authorization framework allows privilege boundaries to be bypassed.

Attack Vector

The attack is network-based and requires the attacker to have valid, low-privileged credentials to the Acronis Cyber Protect 17 system. Once authenticated, the attacker can craft requests to manipulate resources that their account should not have access to. The low attack complexity indicates that exploitation is straightforward once authenticated access is obtained.

The vulnerability can be exploited by sending properly formatted requests to the application's resource management interfaces while authenticated with a low-privilege account. The application's failure to enforce proper authorization checks allows these unauthorized operations to succeed. For detailed technical information, refer to the Acronis Security Advisory SEC-8378.

Detection Methods for CVE-2026-28719

Indicators of Compromise

• Unexpected modifications to backup configurations or protected resources by non-administrative users
• Audit log entries showing resource modifications by accounts without appropriate permissions
• Anomalous API calls or requests to resource management endpoints from low-privilege user sessions

Detection Strategies

• Monitor and audit all resource modification operations within Acronis Cyber Protect 17, paying attention to the originating user account
• Implement alerting for resource changes performed by accounts that do not have administrative privileges
• Review access logs for patterns of unauthorized resource access attempts or successful modifications

Monitoring Recommendations

• Enable detailed logging for all resource management operations in Acronis Cyber Protect 17
• Configure SIEM rules to detect privilege boundary violations and unauthorized resource modifications
• Regularly review audit trails for any anomalous activity from low-privileged user accounts

How to Mitigate CVE-2026-28719

Immediate Actions Required

• Update Acronis Cyber Protect 17 to build 41186 or later on all Linux and Windows deployments
• Audit existing user accounts and remove unnecessary access privileges following the principle of least privilege
• Review system logs for any evidence of exploitation prior to patching

Patch Information

Acronis has released build 41186 for Acronis Cyber Protect 17 which addresses this vulnerability. Organizations should apply this update immediately to both Linux and Windows installations. Detailed patch information is available in the Acronis Security Advisory SEC-8378.

Workarounds

• Restrict network access to Acronis Cyber Protect 17 management interfaces to trusted networks only
• Implement additional network segmentation to limit exposure of the vulnerable application
• Conduct regular access reviews to ensure users only have the minimum permissions necessary for their roles

# Verify Acronis Cyber Protect 17 build version
# Linux:
cat /usr/lib/Acronis/version.txt

# Windows:
# Check build version in Acronis Cyber Protect management console
# Navigate to Help > About to verify version is 41186 or later