CVE-2026-87095

Critical 9.1

Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.

Assigner
Acronis

Published
2026-10-21

Updated
2026-10-21

Reserved
2026-09-08

Scores

Source	CVSS	Score	Severity	Vector
Acronis	3.0	9.1	Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-863

Affected

Vendor	Product	Versions
Acronis	Acronis Cyber Infrastructure ACI	< 6.0.1-112 (affected) others: unaffected
Acronis	Acronis Cyber Infrastructure ACI	< 6.1.1-64 (affected) others: unaffected
Acronis	Acronis Cyber Infrastructure ACI	< 6.2.1-71 (affected) others: unaffected

References

https://security-advisory.acronis.com/advisories/SEC-8128 vendor-advisory

Full CVE JSON record (5.2)

API · GitHub · cve.org

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "ACI"
          ],
          "product": "Acronis Cyber Infrastructure",
          "vendor": "Acronis",
          "versions": [
            {
              "lessThan": "6.0.1-112",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "ACI"
          ],
          "product": "Acronis Cyber Infrastructure",
          "vendor": "Acronis",
          "versions": [
            {
              "lessThan": "6.1.1-64",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "ACI"
          ],
          "product": "Acronis Cyber Infrastructure",
          "vendor": "Acronis",
          "versions": [
            {
              "lessThan": "6.2.1-71",
              "status": "affected",
              "version": "unspecified",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T10:14:03.375Z",
        "orgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175",
        "shortName": "Acronis"
      },
      "references": [
        {
          "name": "SEC-8128",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security-advisory.acronis.com/advisories/SEC-8128"
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "73dc0fef-1c66-4a72-9d2d-0a0f4012c175",
    "assignerShortName": "Acronis",
    "cveId": "CVE-2026-87095",
    "datePublished": "2026-10-21T10:14:03.375Z",
    "dateReserved": "2026-09-08T20:12:11.794Z",
    "dateUpdated": "2026-10-21T10:14:03.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}