{"id":"CVE-2026-87095","kind":"vulnerability","aliases":["CVE-2026-87095"],"related":[],"title":"Acronis Cyber Infrastructure: missing authorization exposes and alters sensitive data","description":"Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.","summary":"Acronis Cyber Infrastructure has an incorrect authorization check (CWE-863). An unauthenticated attacker with network access can read sensitive data and modify data (CVSS 9.1: confidentiality and integrity high, availability none). Acronis does not say which component or endpoint is affected. No exploitation or public PoC is known.","severity":"critical","cvss":9.1,"epss":0.00242,"exploited":false,"exploited_at":null,"products":[{"name":"Acronis Cyber Infrastructure","fixed":["6.0.1-112","6.1.1-64","6.2.1-71"],"affected":"< 6.0.1-112 (6.0.x); < 6.1.1-64 (6.1.x); < 6.2.1-71 (6.2.x)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acronis-cyber-infrastructure","hypervisor","infrastructure","self-hosted"],"not_affected_if":["managed-hosting","unknown"],"how_to_check":"In the ACI admin panel, or on a node, find the installed build and compare it with your release branch. Vulnerable: 6.0.x below 6.0.1-112, 6.1.x below 6.1.1-64, 6.2.x below 6.2.1-71. Branches 7.x are not listed as affected. Also check whether the management panel or API is reachable from untrusted networks.","fix":"Update to build 6.0.1-112, 6.1.1-64 or 6.2.1-71 or later for your branch. Until then, restrict network access to the ACI management interfaces and API.","status":"open","published_at":"2026-10-21T11:17:09+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-23T22:33:18+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:33:18Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to Acronis Cyber Infrastructure build 6.0.1-112, 6.1.1-64, or 6.2.1-71 or later, matching your release branch.","reach":"unknown","title":"Acronis Cyber Infrastructure: missing authorization exposes and alters sensitive data","impact":"high","summary":"Acronis Cyber Infrastructure builds before 6.0.1-112, 6.1.1-64 and 6.2.1-71 fail to check authorization properly. An attacker can read sensitive information and change data they should not reach.","category":"infrastructure","who_cares":["acronis-cyber-infrastructure","hypervisor","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown attacker reads secrets and modifies hypervisor-managed data","analyst_note":"Sources give no attack vector, required privilege or affected component; check the Acronis security advisory for those details and whether an authenticated user is needed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000502,"input_tokens":2950,"output_tokens":414,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give no attack vector, required privilege or affected component; check the Acronis security advisory for those details and whether an authenticated user is needed.","search":"'-112':99C '-2026':12A,15A '-64':107C '-71':115C '-863':38B '-87095':13A,16A '6.0.1':98C '6.1.1':106C '6.2.1':114C '9.1':53B 'access':44B 'aci':95C,103C,111C 'acroni':1A,21B,29B,60B,92C,100C,108C 'acronis':17A 'acronis-cyber-infrastructur':20B 'affect':69B,91C 'alter':8A 'attack':41B 'author':5A,35B,85C 'avail':58B 'build':97C,105C,113C 'check':36B,86C 'compon':65B 'confidenti':54B 'cve':11A,14A 'cvss':52B 'cwe':37B 'cyber':2A,18A,22B,30B,93C,101C,109C 'data':10A,48B,51B 'disclosur':79C 'due':82C 'endpoint':67B 'exploit':71B 'expos':6A 'follow':88C 'high':57B 'host':28B 'hypervisor':24B 'improp':84C 'incorrect':34B 'inform':78C 'infrastructur':3A,23B,25B,31B,94C,102C,110C 'infrastructure':19A 'integr':56B 'known':76B 'manipul':81C 'miss':4A 'modifi':50B 'network':43B 'none':59B 'poc':74B 'product':89C 'public':73B 'read':46B 'say':63B 'self':27B 'self-host':26B 'sensit':9A,47B,77C 'unauthent':40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T11:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@acronis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87095","severity":null,"published_at":"2026-10-21T11:17:09+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87095:315","url":null,"severity":null,"published_at":"2026-10-23T22:51:47+00:00","modified_at":"2026-10-23T22:51:47+00:00","first_seen_at":"2026-10-23T22:51:47+00:00","fetched_at":"2026-10-23T22:51:47+00:00","note":"Read Acronis SEC-8128 (vendor) plus CSIRT Italia; vector is unauthenticated network (CVSS 3.0 AV:N/PR:N, CWE-863). Vendor names no component or endpoint. No exploitation or PoC found; no social search done (obscure)."},{"source":"epss","external_id":"CVE-2026-87095","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87095","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1629,"url":"https://security-advisory.acronis.com/advisories/SEC-8128","title":"Acronis SEC-8128","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1630,"url":"https://csirt.regione.toscana.it/rilevate-vulnerabilita-in-prodotti-acronis-al06-261021-csirt-ita/","title":"CSIRT Italia AL06/261021 Acronis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}