{"id":"CVE-2026-87880","kind":"vulnerability","aliases":["CVE-2026-87880"],"related":[],"title":"Acronis Cyber Protect 17: missing certificate checks expose sensitive data","description":"Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.","summary":"One component of Acronis Cyber Protect 17 does not verify SSL certificates when connecting. A network attacker positioned between the agent and its server could read sensitive information sent over those connections.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acronis-cyber-protect","backup","linux","other","windows"],"not_affected_if":["build-42587-or-later","not-running-acronis"],"how_to_check":"- Confirm the installed Acronis Cyber Protect 17 build number; unknown whether the sources give a command for this.\n- Review which component is named in the advisory; unknown from the sources.","fix":"- Update Acronis Cyber Protect 17 to build `42587` or later, per the advisory's affected range.","status":"open","published_at":"2026-10-28T11:17:28+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:33:29+00:00","updated_at":"2026-10-28T11:33:29+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T11:33:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update Acronis Cyber Protect 17 to build `42587` or later, per the advisory's affected range.","reach":"network","title":"Acronis Cyber Protect 17: missing certificate checks expose sensitive data","impact":"medium","summary":"One component of Acronis Cyber Protect 17 does not verify SSL certificates when connecting. A network attacker positioned between the agent and its server could read sensitive information sent over those connections.","category":"other","nicknames":[],"who_cares":["acronis-cyber-protect","linux","windows","backup"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sensitive data sent by one component is readable by a network attacker.","analyst_note":"Find the vendor advisory naming the affected component and the exact connections that skip certificate checks; check the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-87880.","how_to_check":"- Confirm the installed Acronis Cyber Protect 17 build number; unknown whether the sources give a command for this.\n- Review which component is named in the advisory; unknown from the sources.","needs_analyst":true,"not_affected_if":["not-running-acronis","build-42587-or-later"],"who_is_affected":"Organizations running Acronis Cyber Protect 17 on Linux or Windows at a build before `42587`. The sources do not name the affected component or the exact connection path, so exposure depends on whether that component talks over an untrusted network. Teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000605,"input_tokens":3271,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-87880':13A,16A '17':4A,31B,77C '42587':82C 'acroni':1A,18B,28B,74C 'acronis-cyber-protect':17B 'affect':66C,73C 'agent':45B 'attack':41B 'backup':21B 'build':81C 'certif':6A,36B,64C 'check':7A 'compon':26B,68C 'connect':38B,56B 'could':49B 'cve':11A,14A 'cyber':2A,19B,29B,75C 'data':10A 'disclosur':59C 'due':60C 'expos':8A 'follow':70C 'inform':52B,58C 'linux':22B,78C 'miss':5A,62C 'network':40B 'one':25B,67C 'posit':42B 'product':71C 'protect':3A,20B,30B,76C 'read':50B 'sensit':9A,51B,57C 'sent':53B 'server':48B 'ssl':35B,63C 'verif':65C 'verifi':34B 'window':24B,79C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Acronis Cyber Protect 17 on Linux or Windows at a build before `42587`. The sources do not name the affected component or the exact connection path, so exposure depends on whether that component talks over an untrusted network. Teams not running this product can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@acronis.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87880","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87880","severity":null,"published_at":"2026-10-28T11:17:28+00:00","modified_at":"2026-10-28T11:17:28+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}