---
id: "CVE-2026-87095"
kind: "vulnerability"
aliases: ["CVE-2026-87095"]
title: "Acronis Cyber Infrastructure: missing authorization exposes and alters sensitive data"
severity: "critical"
cvss: 9.1
epss: 0.00242
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Acronis Cyber Infrastructure", "fixed": ["6.0.1-112", "6.1.1-64", "6.2.1-71"], "affected": "< 6.0.1-112 (6.0.x); < 6.1.1-64 (6.1.x); < 6.2.1-71 (6.2.x)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["acronis-cyber-infrastructure", "hypervisor", "infrastructure", "self-hosted"]
not_affected_if: ["managed-hosting", "unknown"]
published_at: "2026-10-21T11:17:09+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87095", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:51:47+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87095", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Acronis Cyber Infrastructure: missing authorization exposes and alters sensitive data

Acronis Cyber Infrastructure has an incorrect authorization check (CWE-863). An unauthenticated attacker with network access can read sensitive data and modify data (CVSS 9.1: confidentiality and integrity high, availability none). Acronis does not say which component or endpoint is affected. No exploitation or public PoC is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Acronis Cyber Infrastructure affected < 6.0.1-112 (6.0.x); < 6.1.1-64 (6.1.x); < 6.2.1-71 (6.2.x) fixed 6.0.1-112, 6.1.1-64, 6.2.1-71

## How to check

In the ACI admin panel, or on a node, find the installed build and compare it with your release branch. Vulnerable: 6.0.x below 6.0.1-112, 6.1.x below 6.1.1-64, 6.2.x below 6.2.1-71. Branches 7.x are not listed as affected. Also check whether the management panel or API is reachable from untrusted networks.

## Fix

Update to build 6.0.1-112, 6.1.1-64 or 6.2.1-71 or later for your branch. Until then, restrict network access to the ACI management interfaces and API.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87095
- 2026-10-23T22:51:47+00:00 analyst — Read Acronis SEC-8128 (vendor) plus CSIRT Italia; vector is unauthenticated network (CVSS 3.0 AV:N/PR:N, CWE-863). Vendor names no component or endpoint. No exploitation or PoC found; no social search done (obscure).
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87095

## Documents

- [advisory] Acronis SEC-8128 https://security-advisory.acronis.com/advisories/SEC-8128
- [mentions] CSIRT Italia AL06/261021 Acronis https://csirt.regione.toscana.it/rilevate-vulnerabilita-in-prodotti-acronis-al06-261021-csirt-ita/

## From the sources

Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_