Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-87095 Overview
CVE-2026-87095 is an improper authorization vulnerability in Acronis Cyber Infrastructure (ACI) that allows unauthenticated network-based attackers to disclose and manipulate sensitive information. The flaw is classified under [CWE-863: Incorrect Authorization] and affects multiple ACI release branches prior to specific patched builds. Successful exploitation does not require user interaction or prior privileges.
Critical Impact
An unauthenticated remote attacker can read and modify sensitive data managed by ACI due to missing authorization checks, undermining the confidentiality and integrity of the hyperconverged infrastructure platform.
Affected Products
- Acronis Cyber Infrastructure (ACI) before build 6.0.1-112
- Acronis Cyber Infrastructure (ACI) before build 6.1.1-64
- Acronis Cyber Infrastructure (ACI) before build 6.2.1-71
Discovery Timeline
- 2026-10-21 - CVE-2026-87095 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-87095
Vulnerability Analysis
The vulnerability stems from improper authorization checks within Acronis Cyber Infrastructure (ACI). ACI is a hyperconverged platform providing storage, compute, and data protection services, and it exposes administrative and data-plane interfaces over the network. When authorization logic fails to validate that a requesting principal has rights to a given object or action, attackers can access or modify resources that should be gated by role or ownership.
Because the attack vector is network-based and requires no credentials or user interaction, any party able to reach the ACI management surface can attempt exploitation. The resulting impact covers both confidentiality (disclosure of sensitive data) and integrity (manipulation of that data), but availability is not reported as affected.
Root Cause
The root cause is a missing or incorrect authorization decision ([CWE-863]) on one or more ACI endpoints. The affected code paths authenticate or accept requests but fail to confirm the caller is entitled to the target resource, allowing cross-tenant or cross-privilege access to sensitive objects.
Attack Vector
An attacker reaches an exposed ACI service over the network and issues crafted requests to endpoints that lack proper authorization enforcement. Because privileges required are none and complexity is low, the request flow needed to trigger disclosure or manipulation is straightforward against unpatched builds. Refer to the Acronis Security Advisory SEC-8128 for vendor-specific technical details.
Detection Methods for CVE-2026-87095
Indicators of Compromise
- Unexpected read or write operations against ACI management APIs from clients that do not correspond to legitimate administrative sources.
- Access to tenant or object resources by principals that have no business relationship with those resources in ACI audit logs.
- Configuration or data changes in ACI that cannot be tied to an authenticated administrator action.
Detection Strategies
- Audit ACI access logs for requests to sensitive endpoints that returned success responses without a corresponding authenticated privileged session.
- Compare current ACI build numbers against the fixed versions (6.0.1-112, 6.1.1-64, 6.2.1-71) to identify exposed nodes.
- Baseline normal API usage per role and alert on deviations such as low-privilege or unauthenticated callers reaching administrative paths.
Monitoring Recommendations
- Forward ACI management, authentication, and API logs to a centralized analytics platform for correlation across the cluster.
- Monitor north-south traffic to ACI management interfaces and alert on access from untrusted network segments.
- Track configuration-change events and object-access patterns to detect manipulation attempts following the disclosure vector.
How to Mitigate CVE-2026-87095
Immediate Actions Required
- Upgrade Acronis Cyber Infrastructure to build 6.0.1-112, 6.1.1-64, or 6.2.1-71 or later according to your release branch.
- Restrict network access to ACI management interfaces to trusted administrative networks only, using firewalls or network ACLs.
- Review ACI audit logs since deployment of the affected builds for signs of unauthorized data access or modification.
Patch Information
Acronis has released fixed builds that address the improper authorization checks. Administrators should apply build 6.0.1-112 for the 6.0 branch, 6.1.1-64 for the 6.1 branch, and 6.2.1-71 for the 6.2 branch. Refer to the Acronis Security Advisory SEC-8128 for upgrade guidance and release notes.
Workarounds
- Place ACI management endpoints behind a VPN or bastion host so they are not reachable from untrusted networks.
- Enforce strict network segmentation between the ACI control plane and tenant or user networks until patching is complete.
- Rotate credentials, API tokens, and keys stored or managed by ACI after upgrading, in case of prior exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
