Acronis Acronis

  1. Vendors
  2. Acronis

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Acronis product.

RSS Feeds for Acronis security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Acronis products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Acronis Sorted by Most Security Vulnerabilities since 2018

Acronis Cyber Protect64 vulnerabilities

Acronis True Image30 vulnerabilities

Acronis Cyber Protect Home Office12 vulnerabilities

Acronis Agent11 vulnerabilities

Acronis Snap Deploy8 vulnerabilities

Acronis Cyber Files5 vulnerabilities

Acronis Cloud Manager3 vulnerabilities

Acronis Cyber Infrastructure3 vulnerabilities

Acronis True Image 20203 vulnerabilities

Acronis Cyber Backup2 vulnerabilities

Acronis Cyber Protect Cloud Agent2 vulnerabilities

Acronis Cyber Protect Cloud1 vulnerability

Acronis Cyber Protection Agent1 vulnerability

Known Exploited Acronis Vulnerabilities

The following Acronis vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title Description Added
Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.
CVE-2023-45249 Exploit Probability: 93.5% 		July 29, 2024

The vulnerability CVE-2023-45249: Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2026 there have been 35 vulnerabilities in Acronis. Last year, in 2025 Acronis had 13 security vulnerabilities published. That is, 22 more vulnerabilities have already been reported in 2026 as compared to last year.




Year Vulnerabilities Average Score
2026 35 0.00
2025 13 7.23
2024 24 6.07
2023 23 7.09
2022 15 7.34
2021 19 7.50
2020 4 7.63

It may take a day or so for new Acronis vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Acronis Security Vulnerabilities

CVE Date Vulnerability Products
CVE-2026-41220 Apr 29, 2026
Acronis DLP & CP Agent <= v9.0.93212/42183 Priv Esc via Input Validation Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
Cyber Protect
CVE-2026-41952 Apr 29, 2026
Acronis DeviceLock DLP & Cyber Protect Agent: LPE before 9.0.93212/42183 Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
Cyber Protect
CVE-2026-25852 Apr 29, 2026
Acronis DeviceLock DLP DLL Hijack Local Priv Esc Pre-9.0.93212 Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.
CVE-2026-33092 Apr 10, 2026
Local Priv Escalation via Improper Env Var Handling in Acronis True Image macOS Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.
True Image
CVE-2026-33271 Apr 02, 2026
Acronis True Image Priv Esc via Folder Permissions Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 42902.
True Image
CVE-2026-27774 Apr 02, 2026
CVE-2026-27774: DLL Hijacking Local Priv Escalation in ACronis True Image Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902.
True Image
CVE-2026-28728 Apr 02, 2026
DLL Hijacking Privilege Escalation in Acronis True Image on Windows <42902 Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902.
True Image
CVE-2026-28726 Mar 05, 2026
Sensitive Info Disclosure in Acronis Cyber Protect 17 via Improper Access Sensitive information disclosure due to improper access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28725 Mar 05, 2026
Acronis Cyber Protect 17 Pre-41186 info leak via config headless browser Sensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2025-30413 Mar 05, 2026
Acronis Agent Credentials Not Cleared After Plan Revocation Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Cyber Protect
CVE-2026-28724 Mar 05, 2026
Acronis Cyber Protect 17: Insufficient Access Controls Grant Data Access Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28723 Mar 05, 2026
Acronis Cyber Protect Unauthorized Report Deletion via Access Control Flaw Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28722 Mar 05, 2026
Local Priv Escalation via Soft Link Abuse in Acronis Cyber Protect 17 Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Cyber Protect
CVE-2026-28721 Mar 05, 2026
Local Priv Esc via Soft Link in Acronis Cyber Protect 17 Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Cyber Protect
CVE-2026-28720 Mar 05, 2026
Acronis Cyber Protect 17: Unauthorized Settings Modification - Weak Auth Checks Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28719 Mar 05, 2026
Acronis Cyber Protect 17: Auth Flaw Enables Unauthorized Resource Manip Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28718 Mar 05, 2026
Acronis Cyber Protect DoS via Auth Log Insufficient Validation Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28717 Mar 05, 2026
Local Privilege Escalation in Acronis Cyber Protect 17 Windows Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Cyber Protect
CVE-2026-28716 Mar 05, 2026
CVE-2026-28716: Improper Authorization in Acronis Cyber Protect 17 Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28715 Mar 05, 2026
CVE-2026-28715: Acronis Cyber Protect 17 Info Disclosure via Auth Checks Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28714 Mar 05, 2026
Acronis Cyber Protect 17 Sensitive Crypto Leak (CVE-2026-28714) Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28713 Mar 05, 2026
CVE-2026-28713: Default credentials for local privileged user in Virtual Appliance Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.
Cyber Protect
CVE-2026-28712 Mar 05, 2026
Dll Hijack LPE in Acronis Cyber Protect 17 Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Cyber Protect
CVE-2026-28711 Mar 05, 2026
LPE via DLL Hijacking in Acronis Cyber Protect 17 Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
Cyber Protect
CVE-2026-28710 Mar 05, 2026
Acronis Cyber Protect 17 Auth Bypass Sensitive Info Disclosure Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2026-28709 Mar 05, 2026
Acronis Cyber Protect 17 Unauth. Resource Manipulation via Auth Bypass Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Cyber Protect
CVE-2025-11790 Mar 05, 2026
CVE-2025-11790: Acronis Agent Credential Retention After Plan Revocation Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.
Cyber Protect
CVE-2025-11791 Mar 05, 2026
Acronis Cyber Protect: Info Disclosure via Missing Auth Checks Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186, Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.
Cyber Protect
CVE-2025-11792 Mar 05, 2026
Local Priv Esc via DLL Hijacking in Acronis Cyber Protect Cloud Agent Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124.
Cyber Protect
CVE-2026-28727 Mar 05, 2026
Acronis Cyber Protect Local Priv Esc via Insecure Unix Socket Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124, Acronis True Image (macOS) before build 42902.
Cyber Protect
True Image
CVE-2025-30416 Feb 20, 2026
Acronis Cyber Protect Sensitive Data Disclosure via Missing Authorization Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
Cyber Protect
CVE-2025-30410 Feb 20, 2026
Acronis Cyber Protect: Authless Sensitive Data Disclosure (CVE-2025-30410) Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 41800.
Cyber Protect
CVE-2025-30412 Feb 20, 2026
Acronis Cyber Protect 15/16 Improper Auth Exposes Sensitive Data Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
Cyber Protect
CVE-2025-30411 Feb 20, 2026
Acronis Cyber Protect 15/16 Improper Auth Exposes Sensitive Data Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.
Cyber Protect
CVE-2026-0705 Jan 27, 2026
Acronis Cloud Manager <6.4.25342.354 Windows: Priv Esc Insecure Folder Perms Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.4.25342.354.
Cloud Manager
CVE-2025-7779 Sep 30, 2025
Local PrivEsc via Insecure XPC Service in Acronis True Image (macOS) Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) before build 42389, Acronis True Image for SanDisk (macOS) before build 42198, Acronis True Image for Western Digital (macOS) before build 42197, Acronis True Image OEM (macOS) before build 42571.
True Image
CVE-2025-11178 Sep 30, 2025
Acronis True Image local privilege escalation via DLL hijacking Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) before build 42679, Acronis True Image OEM (Windows) before build 42575.
True Image
CVE-2025-48961 Jun 04, 2025
Acronis Cyber Protect 16 Windows: PrivEsc via Insecure Folder Permissions Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938.
Cyber Protect
CVE-2025-30415 Jun 04, 2025
DoS in Acronis Cyber Protect Cloud Agent from malformed input Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40077, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Cyber Protect
CVE-2025-48959 Jun 04, 2025
Acronis Cyber Protect Cloud Agent: LPE via Insecure File Permissions Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40077.
Cyber Protect
CVE-2025-30409 Apr 24, 2025
Acronis Cyber Protect Cloud Agent DoS via Unbounded Resource Allocation Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 17 (Windows) before build 41186.
Cyber Protect
CVE-2025-30408 Apr 24, 2025
Acronis Cyber Protect Cloud Agent & 16 Local Priv Esc via insecure folder perms Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 16 (Windows) before build 39938.
Cyber Protect
CVE-2025-24826 Jan 28, 2025
Acronis Snap Deploy (Windows) PrivEsc via Insecure Folder Permissions Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4625.
Snap Deploy
CVE-2024-55543 Jan 02, 2025
DLL hijacking leads to local privilege escalation in Acronis Cyber Protect Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Cyber Protect
CVE-2024-55541 Jan 02, 2025
Acronis Cyber Protect XSS via postMessage origin validation flaw Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39169.
Cyber Protect
CVE-2024-55540 Jan 02, 2025
Acronis Cyber Protect 16 DLL Hijacking LPE Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Cyber Protect
CVE-2024-55538 Jan 02, 2025
Acronis True Image (pre-41736/41725) Sensitive Info Disclosure via Missing Auth Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis True Image (Windows) before build 41736, Acronis True Image OEM (macOS) before build 42571, Acronis True Image OEM (Windows) before build 42575.
True Image
CVE-2024-49385 Jan 02, 2025
Acronis True Image Windows Info Disclosure via Insecure Folder Perms Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acronis True Image OEM (Windows) before build 42575.
True Image
CVE-2024-49386 Oct 17, 2024
Acronis Cyber Files <9.0.0x24: Sensitive Info Disclosure via Spell-Jacking Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
Cyber Files
CVE-2024-49392 Oct 17, 2024
Acronis Cyber Files stored XSS before 9.0.0x24 enrollment invite Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
Cyber Files
Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.