---
id: "CVE-2026-87879"
kind: "vulnerability"
aliases: ["CVE-2026-87879"]
title: "Acronis Cyber Protect 17: token validation flaw leaks sensitive information"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["acronis", "backup", "infrastructure", "linux", "windows"]
not_affected_if: []
published_at: "2026-10-28T11:17:28+00:00"
first_seen_at: "2026-10-28T11:32:34+00:00"
updated_at: "2026-10-28T11:33:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87879", "first_seen_at": "2026-10-28T11:32:34+00:00"}]
---

# Acronis Cyber Protect 17: token validation flaw leaks sensitive information

Acronis Cyber Protect 17 on Linux and Windows does not validate tokens properly, which allows sensitive information to be disclosed. The sources do not say which data is exposed or what the attacker must send.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Acronis Cyber Protect build number in the product's About or version view; the sources do not give a command.
- unknown

## Fix

- Move Acronis Cyber Protect 17 to build `42587` or later, per the affected-version note in the sources.
- unknown

## Timeline

- 2026-10-28T11:32:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87879

## From the sources

Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_