---
id: "CVE-2026-87101"
kind: "vulnerability"
aliases: ["CVE-2026-87101"]
title: "Acronis Cyber Protect 17: improper token validation leaks sensitive information"
severity: "medium"
cvss: 6.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["acronis-cyber-protect", "linux", "other", "windows"]
not_affected_if: ["build-42587-or-later"]
published_at: "2026-10-28T11:17:27+00:00"
first_seen_at: "2026-10-28T11:32:34+00:00"
updated_at: "2026-10-28T11:33:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87101", "first_seen_at": "2026-10-28T11:32:34+00:00"}]
---

# Acronis Cyber Protect 17: improper token validation leaks sensitive information

Acronis Cyber Protect 17 on Linux and Windows, before build 42587, does not validate tokens properly. An attacker can read sensitive information the product should keep from them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Acronis Cyber Protect 17 build number in the product's About or version screen; the sources do not give a command.

## Fix

- Update Acronis Cyber Protect 17 to build `42587` or later, as stated in the advisory text.

## Timeline

- 2026-10-28T11:32:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87101

## From the sources

Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_