CVE-2026-28725: Acronis Cyber Protect Info Disclosure Bug

CVE-2026-28725 Overview

CVE-2026-28725 is a sensitive information disclosure vulnerability affecting Acronis Cyber Protect 17 due to improper configuration of a headless browser component. This vulnerability allows a local attacker with low privileges to access sensitive information that should otherwise be protected, potentially exposing confidential data stored or processed by the backup and security solution.

Critical Impact

Local attackers can exploit misconfigured headless browser settings to gain unauthorized access to sensitive information, compromising data confidentiality in enterprise backup environments.

Affected Products

• Acronis Cyber Protect 17 (Linux) before build 41186
• Acronis Cyber Protect 17 (Windows) before build 41186

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-28725 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-28725

Vulnerability Analysis

This vulnerability stems from CWE-732: Incorrect Permission Assignment for Critical Resource. The headless browser component within Acronis Cyber Protect 17 is configured with overly permissive settings, allowing local users to access sensitive information that would normally be restricted. Headless browsers are commonly used in backup and security solutions for web-based reporting, automation tasks, and interface rendering without a graphical display.

The improper configuration creates a pathway for authenticated local users to extract confidential data. Since the attack vector is local, an attacker would need existing access to the target system, but only requires low-level privileges to exploit the vulnerability. No user interaction is required to trigger the information disclosure.

Root Cause

The root cause is improper permission assignment for the headless browser configuration. The browser component runs with insufficient access controls, failing to properly restrict which users or processes can interact with it and access the data it processes. This represents a failure to implement the principle of least privilege for the browser component's configuration and runtime environment.

Attack Vector

The attack is executed locally on systems running vulnerable versions of Acronis Cyber Protect 17. An attacker with low-privilege access to a Linux or Windows system can interact with the improperly configured headless browser to extract sensitive information. The attack does not require user interaction and directly impacts the confidentiality of data processed by the application, though integrity and availability remain unaffected.

The vulnerability mechanism involves exploiting the misconfigured browser permissions to read data that the headless browser component has access to, which may include backup credentials, configuration settings, or other sensitive operational data managed by Acronis Cyber Protect. For detailed technical information, refer to the Acronis Security Advisory SEC-8695.

Detection Methods for CVE-2026-28725

Indicators of Compromise

• Unusual access patterns to headless browser processes or related temporary files by non-administrative users
• Unexpected read operations on Acronis Cyber Protect configuration directories by low-privilege accounts
• Process execution anomalies involving browser components running under unexpected user contexts

Detection Strategies

• Monitor file system access events for Acronis Cyber Protect browser component directories and configuration files
• Implement process monitoring to detect unauthorized interactions with headless browser instances
• Review authentication and access logs for suspicious local user activity on systems running Acronis Cyber Protect 17

Monitoring Recommendations

• Enable detailed audit logging for file access events on Acronis Cyber Protect installation directories
• Configure endpoint detection to alert on process injection or manipulation targeting browser components
• Establish baseline behavior for Acronis services and alert on deviations in process relationships

How to Mitigate CVE-2026-28725

Immediate Actions Required

• Upgrade Acronis Cyber Protect 17 to build 41186 or later on all affected Linux and Windows systems
• Audit user access to systems running vulnerable versions to identify potential exploitation
• Review access logs for any signs of unauthorized information access prior to patching
• Restrict local user permissions to minimize the attack surface until patches can be applied

Patch Information

Acronis has released build 41186 which addresses the headless browser configuration vulnerability. Administrators should apply this update as soon as possible to all installations of Acronis Cyber Protect 17 on both Linux and Windows platforms. Consult the Acronis Security Advisory SEC-8695 for official patch details and download information.

Workarounds

• Limit local user access to systems running Acronis Cyber Protect 17 to only necessary personnel
• Implement additional access controls around Acronis Cyber Protect processes and configuration directories
• Consider network segmentation to isolate backup infrastructure from general user populations
• Monitor and audit access to Acronis-related files and processes until the patch is applied

# Verify Acronis Cyber Protect build version (Windows PowerShell)
# Check if version is 41186 or higher to confirm patch status
Get-ItemProperty "HKLM:\SOFTWARE\Acronis\Cyber Protect" | Select-Object -Property BuildNumber