{"id":"CVE-2026-87097","kind":"vulnerability","aliases":["CVE-2026-87097"],"related":[],"title":"Acronis Cyber Protect 17: insufficiently protected credentials expose sensitive information","description":"Sensitive information disclosure due to insufficiently protected credentials. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.","summary":"Acronis Cyber Protect 17 builds before 42587 store credentials insufficiently protected, so sensitive information can be disclosed. An attacker who can read those stored credentials could reuse them against the backup and protection environment.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acronis-cyber-protect","backup","linux","other","windows"],"not_affected_if":["build-42587-or-later"],"how_to_check":"- Check the installed Acronis Cyber Protect 17 build number in the product's About dialog or console\n- unknown for any other check, as the sources do not say where the credentials are stored","fix":"- Update Acronis Cyber Protect 17 to build `42587` or later\n- Rotate any credentials stored by affected agents after patching, as the sources do not say whether prior exposure occurred","status":"open","published_at":"2026-10-28T11:17:27+00:00","first_seen_at":"2026-10-28T11:32:33+00:00","triaged_at":"2026-10-28T11:33:36+00:00","updated_at":"2026-10-28T11:33:36+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T11:33:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update Acronis Cyber Protect 17 to build `42587` or later\n- Rotate any credentials stored by affected agents after patching, as the sources do not say whether prior exposure occurred","reach":"unknown","title":"Acronis Cyber Protect 17: insufficiently protected credentials expose sensitive information","impact":"medium","summary":"Acronis Cyber Protect 17 builds before 42587 store credentials insufficiently protected, so sensitive information can be disclosed. An attacker who can read those stored credentials could reuse them against the backup and protection environment.","category":"other","nicknames":[],"who_cares":["acronis-cyber-protect","linux","windows","backup"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Stored credentials readable, enabling reuse against protected systems","analyst_note":"Check the NVD entry and the Acronis advisory for where credentials are stored, who can read them, and whether the fix is build 42587.","how_to_check":"- Check the installed Acronis Cyber Protect 17 build number in the product's About dialog or console\n- unknown for any other check, as the sources do not say where the credentials are stored","needs_analyst":true,"not_affected_if":["build-42587-or-later"],"who_is_affected":"Teams running Acronis Cyber Protect 17 on Linux or Windows with a build earlier than 42587. The sources do not describe the exact data path or configuration that exposes the credentials, so whether a given deployment is reachable is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000607,"input_tokens":3261,"output_tokens":561,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87097':13A,16A '17':4A,28B,75C '42587':31B,80C 'acroni':1A,18B,25B,72C 'acronis-cyber-protect':17B 'affect':71C 'attack':43B 'backup':21B,55B 'build':29B,79C 'could':50B 'credenti':7A,33B,49B,66C 'cve':11A,14A 'cyber':2A,19B,26B,73C 'disclos':41B 'disclosur':61C 'due':62C 'environ':58B 'expos':8A 'follow':68C 'inform':10A,38B,60C 'insuffici':5A,34B,64C 'linux':22B,76C 'product':69C 'protect':3A,6A,20B,27B,35B,57B,65C,74C 'read':46B 'reus':51B 'sensit':9A,37B,59C 'store':32B,48B 'window':24B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams running Acronis Cyber Protect 17 on Linux or Windows with a build earlier than 42587. The sources do not describe the exact data path or configuration that exposes the credentials, so whether a given deployment is reachable is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@acronis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87097","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87097","severity":null,"published_at":"2026-10-28T11:17:27+00:00","modified_at":"2026-10-28T11:17:27+00:00","first_seen_at":"2026-10-28T11:32:33+00:00","fetched_at":"2026-10-28T11:32:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}