CVE-2026-87096: Acronis Cyber Infrastructure Disclosure Flaw

CVE-2026-87096 Overview

CVE-2026-87096 is an improper authorization vulnerability [CWE-863] in Acronis Cyber Infrastructure (ACI). The flaw allows a remote authenticated attacker with high privileges to disclose or manipulate sensitive information. Exploitation does not require user interaction, but the attack complexity is high. The issue affects multiple ACI builds across the 6.0, 6.1, and 6.2 release trains. Acronis addressed the vulnerability in builds 6.0.1-112, 6.1.1-64, and 6.2.1-71. The vendor documented the issue in Acronis Security Advisory SEC-8129.

Critical Impact
Authenticated attackers can bypass authorization checks to read or modify sensitive data stored within Acronis Cyber Infrastructure deployments.

Affected Products

Acronis Cyber Infrastructure (ACI) before build 6.0.1-112
Acronis Cyber Infrastructure (ACI) before build 6.1.1-64
Acronis Cyber Infrastructure (ACI) before build 6.2.1-71

Discovery Timeline

2026-10-21 - CVE CVE-2026-87096 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-87096

Vulnerability Analysis

The vulnerability stems from missing or incorrect authorization checks within Acronis Cyber Infrastructure. ACI is a hyperconverged infrastructure platform providing compute, storage, and data protection services. When a privileged but unauthorized actor interacts with specific endpoints, the platform fails to verify whether the caller possesses the required permissions for the requested resource.

This gap enables both confidentiality and integrity violations. An attacker can read data belonging to other tenants or administrative scopes and may also modify configuration or metadata outside their authorized boundary. Availability of the service is not impacted. The high privileges requirement and high attack complexity limit the realistic attacker population to authenticated users already positioned within the environment.

Root Cause

The root cause is an improper authorization condition classified under [CWE-863]. Specific code paths within ACI accept requests from authenticated principals without re-validating that the principal is entitled to act on the requested object. Authentication alone is insufficient when authorization logic is incomplete or inconsistent across API handlers.

Attack Vector

Exploitation occurs over the network against the ACI management plane. The attacker must already hold high-privilege credentials to the target instance. After authentication, the attacker issues crafted requests to endpoints affected by the authorization gap and receives data or performs modifications that should be out of scope. No user interaction is required, and the scope of the attack remains confined to the affected component.

No public proof-of-concept exploit is listed in exploit databases, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. The EPSS score sits in the low range, consistent with the authentication and complexity prerequisites.

See the Acronis Security Advisory SEC-8129 for additional vendor-specific technical detail.

Detection Methods for CVE-2026-87096

Indicators of Compromise

Unexpected read or modification events on ACI objects performed by administrative accounts outside their normal operational scope.
API requests from privileged accounts targeting resources associated with other tenants, projects, or clusters.
Audit log entries showing successful actions against endpoints that are inconsistent with the acting user's documented role.

Detection Strategies

Review Acronis Cyber Infrastructure audit logs for authorization decisions associated with high-privilege accounts and cross-reference against expected role assignments.
Baseline normal administrative API usage per account and alert on deviations, including unusual object access patterns or configuration changes.
Correlate authentication events with subsequent API activity to identify privileged sessions that touch resources outside their assigned scope.

Monitoring Recommendations

Forward ACI management plane logs to a centralized SIEM for long-term retention and correlation across identity, endpoint, and infrastructure telemetry.
Monitor for creation, modification, or deletion of ACI roles, API tokens, and service accounts, which can indicate preparation for abuse of the authorization gap.
Track access to sensitive storage, backup, and tenant metadata objects and alert on anomalous read volumes.

How to Mitigate CVE-2026-87096

Immediate Actions Required

Upgrade Acronis Cyber Infrastructure to build 6.0.1-112, 6.1.1-64, or 6.2.1-71 or later, depending on the deployed release train.
Audit all high-privilege ACI accounts, remove unused credentials, and rotate secrets for accounts that may have been exposed.
Review recent audit logs for evidence of unauthorized access or modification by privileged users prior to patching.

Patch Information

Acronis has released fixed builds for all affected release trains. Administrators should install build 6.0.1-112 for 6.0.x deployments, build 6.1.1-64 for 6.1.x deployments, and build 6.2.1-71 for 6.2.x deployments. Patch sources and release notes are available through the Acronis Security Advisory SEC-8129.

Workarounds

Restrict network access to the ACI management interface to trusted administrative networks and jump hosts only.
Enforce the principle of least privilege for ACI administrative roles and remove unnecessary high-privilege assignments until patching completes.
Require multi-factor authentication for all accounts with administrative access to ACI to reduce the risk of credential compromise enabling exploitation.

bash

# Verify installed Acronis Cyber Infrastructure build
rpm -qa | grep -i acronis
# Compare the reported build against the fixed versions:
#   6.0.x -> 6.0.1-112
#   6.1.x -> 6.1.1-64
#   6.2.x -> 6.2.1-71