{"id":"CVE-2026-87878","kind":"vulnerability","aliases":["CVE-2026-87878"],"related":[],"title":"Acronis Cyber Protect 17 Linux binaries ship with executable stack","description":"Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.","summary":"Linux binaries in Acronis Cyber Protect 17 are built with the executable-stack attribute enabled, which weakens memory protections. An attacker who can already feed the program crafted input may more easily turn a memory bug into code execution.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acronis","backup","linux","vendor"],"not_affected_if":["fixed-build"],"how_to_check":"- Check the installed Acronis Cyber Protect build number in the product's about or version screen, and compare it with `42587`\n- Run `readelf -lW <binary> | grep GNU_STACK` on the Acronis Linux binaries and look for `RWE` flags (unknown whether the sources name specific binary paths)","fix":"- Update Acronis Cyber Protect 17 (Linux) to build `42587` or later\n- unknown whether a workaround exists before the update","status":"open","published_at":"2026-10-28T11:17:28+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:33:31+00:00","updated_at":"2026-10-28T11:33:31+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-28T11:33:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update Acronis Cyber Protect 17 (Linux) to build `42587` or later\n- unknown whether a workaround exists before the update","reach":"unknown","title":"Acronis Cyber Protect 17 Linux binaries ship with executable stack","impact":"medium","summary":"Linux binaries in Acronis Cyber Protect 17 are built with the executable-stack attribute enabled, which weakens memory protections. An attacker who can already feed the program crafted input may more easily turn a memory bug into code execution.","category":"vendor","nicknames":[],"who_cares":["acronis","linux","backup"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Memory exploits become easier to turn into code execution","analyst_note":"Sources give only the NVD one-liner; check the vendor advisory for affected binaries, attack preconditions and the fixed build notes.","how_to_check":"- Check the installed Acronis Cyber Protect build number in the product's about or version screen, and compare it with `42587`\n- Run `readelf -lW <binary> | grep GNU_STACK` on the Acronis Linux binaries and look for `RWE` flags (unknown whether the sources name specific binary paths)","needs_analyst":true,"not_affected_if":["fixed-build"],"who_is_affected":"Teams running Acronis Cyber Protect 17 on Linux before build `42587` are affected. Systems on newer builds, or on other platforms, are not listed as affected in the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3247,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87878':13A,16A '17':4A,27B,76C '42587':80C 'acroni':1A,17B,24B,73C 'affect':72C 'alreadi':45B 'attack':42B 'attribut':35B,66C 'backup':18B 'binari':6A,22B,62C 'bug':57B 'build':79C 'built':29B 'code':59B 'craft':49B 'cve':11A,14A 'cyber':2A,25B,74C 'easili':53B 'enabl':36B,67C 'execut':9A,33B,60B,64C 'executable-stack':32B 'feed':46B 'follow':69C 'input':50B 'linux':5A,19B,21B,61C,77C 'may':51B 'memori':39B,56B 'product':70C 'program':48B 'protect':3A,26B,40B,75C 'ship':7A 'stack':10A,34B,65C 'turn':54B 'vendor':20B 'weaken':38B","nicknames":[],"mitigations":[],"who_affected":"Teams running Acronis Cyber Protect 17 on Linux before build `42587` are affected. Systems on newer builds, or on other platforms, are not listed as affected in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@acronis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87878","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87878","severity":null,"published_at":"2026-10-28T11:17:28+00:00","modified_at":"2026-10-28T11:17:28+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}