How do I check whether I am affected by CVE-2026-87103?

- Check the installed Acronis Cyber Protect 17 build number in the product console or agent about page. - unknown for any other check; the sources do not say.

What is the fix for CVE-2026-87103?

- Upgrade Acronis Cyber Protect 17 to build `42587` or later. - unknown for any other action; the sources do not say.

Live › vulnerability › CVE-2026-87103

Go to dashboard

high7.4Other

Acronis Cyber Protect 17: improper token validation exposes sensitive data

Acronis Cyber Protect 17 builds before 42587 do not validate tokens properly, per the NVD entry. An attacker can read sensitive information and manipulate data through this flaw.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.4

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker reads sensitive information and manipulates data.
CVSS said: 7.4. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

Teams running Acronis Cyber Protect 17 on Linux or Windows with a build older than 42587. The sources do not say which deployment or configuration makes the flaw reachable, so unknown whether managed or default setups are exposed.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-87103

Go to dashboard

high7.4Other

Acronis Cyber Protect 17: improper token validation exposes sensitive data

Acronis Cyber Protect 17 builds before 42587 do not validate tokens properly, per the NVD entry. An attacker can read sensitive information and manipulate data through this flaw.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

7.4

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 28, 2026 UTC
Last modified: Oct 28, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: Not known from the sources.
Worst case: Attacker reads sensitive information and manipulates data.
CVSS said: 7.4. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Acronis Cyber Protect 17: improper token validation exposes sensitive data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Acronis Cyber Protect 17: improper token validation exposes sensitive data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources