Acronis Cyber Infrastructure: Improper authorization checks

Summary

Acronis Cyber Infrastructure (ACI) builds before 6.0.1-112, 6.1.1-64 and 6.2.1-71 contain improper authorization checks (CWE-863). According to the CNA record, an attacker can disclose sensitive information and manipulate data. The CNA rates the issue critical (CVSS 9.1) and the vector indicates network access without authentication or user interaction. The product's function is not described in the sources reviewed, so check the vendor advisory before describing it to customers.

Affected

• ACI before build 6.0.1-112
• ACI before build 6.1.1-64
• ACI before build 6.2.1-71
• Other ACI branches: Unknown.

Fixed in

• ACI 6.0 build 6.0.1-112 (UPD-2412-4e16-4234)
• ACI 6.1 build 6.1.1-64 (UPD-2412-49e2-786e)
• ACI 6.2 build 6.2.1-71 (UPD-2412-7fef-a2db)
• Note: the advisory snippet shows publication dates that conflict with the 2026 CVE date. Verify the update details on the advisory page.

Workaround

Unknown. No workaround or mitigation was found in the sources; the Italian CSIRT (ACN) recommends applying the vendor updates.

Exploitation

• No known exploitation in the wild.
• Not listed in CISA KEV.
• No public proof of concept found.
• CISA SSVC: automatable yes, technical impact total.

Our recommendation

• Inventory all ACI installations and their build numbers, including those run by managed service providers.
• Update to 6.0.1-112, 6.1.1-64 or 6.2.1-71 or later, depending on the branch, as described in SEC-8128.
• Verify that no ACI management interface is reachable from the internet, and review access logs for the period before patching.
• Recheck the NVD record and the Acronis advisory in a few days for changes to scoring or exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Acronis Advisory SEC-8128 security-advisory.acronis.com
• OpenCVE CVE-2026-87095 app.opencve.io
• VulDB 424729 vuldb.com
• ACN Italian CSIRT alert on Acronis products www.acn.gov.it
• Acronis Trust Center www.acronis.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:40.