CVE-2026-87096: Low severity Acronis Cyber Infrastructure (ACI) vulnerability
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges. It is not exploitable by an unauthenticated or low-privileged attacker based on the provided CVSS vector.
Which ACI deployments are affected?
Affected deployments are Acronis Cyber Infrastructure versions earlier than build 6.0.1-112, 6.1.1-64, or 6.2.1-71, depending on the release branch in use.
Can this vulnerability be exploited remotely?
Yes. The CVSS vector identifies the attack vector as network-based, although exploitation also requires high privileges and high attack complexity.
What is the potential impact if exploited?
An attacker may disclose sensitive information and manipulate information. The reported impact is limited confidentiality and integrity impact, with no availability impact.