CVE-2022-3405

CVE-2022-3405 affects Acronis Cyber Protect 15 (Windows, Linux) before build 29486 and Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545, caused by excessive privileges granted to the Acronis Agent which enables code execution and sensitive information disclosure. Public disclosures i...

CVE-2023-48682

CVE-2023-48682 is a stored XSS in the unit name of Acronis Cyber Protect 16 (Linux/Windows) prior to build 37391. The vulnerability is due to unsanitized unit-name input, with impact limited to higher-risk confidentiality and integrity in some disclosures, and no availability impact. A fixed vers...

CVE-2023-48678

CVE-2023-48678 affects Acronis Cyber Protect 16 (Linux and Windows) before build 37391. Root cause: insecure folder permissions leading to sensitive information disclosure. CVSS 3.1/3.0 base metrics indicate high confidentiality impact with local, low-complexity access and low privileges required...

CVE-2023-48679

CVE-2023-48679 affects Acronis Cyber Protect 16 (Linux/Windows) prior to build 37391. The vulnerability is a stored cross-site scripting (XSS) caused by missing origin validation in postMessage. The PT-2024-13620 entry confirms the affected versions and identifies the root cause as lack of origin...

CVE-2023-48680

CVE-2023-48680 affects Acronis Cyber Protect 16 (macOS, Windows) prior to build 37391. The issue is an information disclosure caused by excessive collection of system information. Impact is information disclosure with confidentiality impact (per CVSS) and is described as a local issue. Remediatio...

CVE-2023-48681

Acronis Cyber Protect 16 (Linux, Windows) before build 37391 has a self XSS vulnerability in the storage nodes search field. The issue allows execution of malicious scripts in the app context. Mitigation: upgrade to build 37391 or later; as a temporary workaround, restrict access to the storage n...

CVE-2022-30995

CVE-2022-30995 affects Acronis Cyber Protect 15 (Windows, Linux) before build 29486 and Acronis Cyber Backup 12.5 (Windows, Linux) before build 16545. The root cause is an improper authentication flow that leads to sensitive information disclosure. Public sources (NVD, Red Hat, CIRCL/CVE data) de...

CVE-2020-10138

CVE-2020-10138 affects Acronis Cyber Backup 12.5 and Cyber Protect 15, where an OpenSSL component uses an OPENSSLDIR in C:\jenkins_agent\ and a privileged service exposes a local path traversal/vector. Unprivileged Windows users can create directories off the system root to point an openssl.cnf a...

CVE-2022-30990

CVE-2022-30990 involves an information-disclosure vulnerability caused by insecure folder permissions in Acronis Cyber Protect 15 (Linux) before build 29240 and Acronis Agent (Linux) before build 28037. The issue’s root cause is improper access control on directories leading to exposure of sensit...

CVE-2022-45451

CVE-2022-45451 is a local privilege escalation affecting Acronis products on Windows due to insecure driver communication port permissions. Affected: Acronis Cyber Protect Home Office (before build 40173), Acronis Agent (before 30600), and Acronis Cyber Protect 15 (before 30984). Root cause: inse...

CVE-2024-49388

CVE-2024-49388 affects Acronis Cyber Protect 16 (Linux, Windows) prior to build 38690. The root cause is improper authorization, enabling manipulation of sensitive information and, per PT-2024-7387, potential privilege elevation and data exposure for a remote attacker. Public details across conne...

CVE-2024-49387

Acronis Cyber Protect 16 (Linux/Windows) is affected by a vulnerability in the acep-collector service where sensitive data is transmitted in cleartext before build 38690. The issue stems from unencrypted transmission within acep-collector, potentially exposing confidential information. Affected v...

CVE-2022-30991

CVE-2022-30991 affects Acronis Cyber Protect 15 (Linux and Windows) before build 29240. The issue is HTML injection via the report name. Connected sources confirm the affected product/version and the vulnerability class; remediation guidance is to update to a version after build 29240. Exploitati...

CVE-2024-55540

CVE-2024-55540 describes a local privilege escalation caused by DLL hijacking in Acronis Cyber Protect 16 for Windows (pre-build 39169). The available connected documents confirm the root cause as DLL hijacking and identify the affected product by name; no other exploit details, attacker vector, ...

CVE-2021-44204

The CVE-2021-44204 entry concerns a local privilege escalation via named pipes caused by improper access control checks. Affected Windows products and builds include: Acronis Cyber Protect 15 before 28035, Acronis Agent before 27147, Acronis Cyber Protect Home Office before 39612, and Acronis Tru...

CVE-2022-30993

CVE-2022-30993 affects Acronis Cyber Protect 15 (Linux, Windows) before build 29240. The issue is a cleartext transmission of sensitive information. Root cause: data in transit is not encrypted as described in sources; impact includes potential exposure of sensitive data (confidentiality). The CV...

CVE-2020-35556

CVE-2020-35556 affects Acronis Cyber Protect before 15 Update 1 build 26172. The root cause is a misconfigured CORS policy in the local notification service, enabling information disclosure. Documents consistently cite potential exposure but do not provide specific exploit details, affected subco...

CVE-2022-45455

CVE-2022-45455 affects Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, and Acronis Cyber Protect 15 (Windows) before build 30984. The issue is a local privilege escalation caused by incomplete uninstall cleanup, allowing an attacker to e...

CVE-2022-45454

CVE-2022-45454 affects Acronis Agent (Windows) before build 30161 and Acronis Cyber Protect 15 (Windows) before build 30984. Root cause is insecure folder permissions, causing potential disclosure of sensitive information. Affected products: Acronis Agent (Windows) prior to 30161; Acronis Cyber P...

CVE-2023-41745

CVE-2023-41745 affects Acronis Agent (Linux, macOS, Windows) before build 30991 and Acronis Cyber Protect 15 before build 35979. The underlying issue is excessive collection of system information, causing disclosure of sensitive data. Exploitation details are not provided in the connected documen...

CVE-2024-49383

CVE-2024-49383 affects Acronis Cyber Protect 16 (Linux and Windows) prior to build 38690. The root cause is the acep-importer service binding to an unrestricted IP address, creating an excessive attack surface. Documents from multiple sources confirm the affected product/version and the potential...

CVE-2022-30992

CVE-2022-30992 affects Acronis Cyber Protect 15 (Linux/Windows) before build 29240, with an input validation/open redirect vulnerability via a user-controlled query parameter. Root cause cited as input validation error; impact is open redirect. Connected sources (CNVD/CNNVD/NVD) confirm the affec...

CVE-2023-41743

The CVE-2023-41743 issue is a local privilege escalation in Acronis products due to insecure driver communication port permissions. Affected: Acronis Cyber Protect Home Office (Windows) < build 40278; Acronis Agent (Windows) < build 31637; Acronis Cyber Protect 15 (Windows)

CVE-2024-49382

The CVE-2024-49382 issue affects Acronis Cyber Protect 16 (Linux and Windows) prior to build 38690. The archive-server service binds to an unrestricted IP address, creating an excessive attack surface due to exposure. A confirmed remediation is to update to build 38690 or later; PT Security also ...

CVE-2024-55543

The connected PT-2025-3130 entry provides concrete details for CVE-2024-55543: affected software is Acronis Cyber Protect 16 (Windows) with builds before 39169, vulnerable due to DLL hijacking that enables local privilege escalation. Remediation is to update to a version after build 39169; as a t...

CVE-2022-30994

CVE-2022-30994 concerns plaintext transmission of sensitive information in Acronis Cyber Protect 15 (Windows) before build 29240. The available sources explicitly note a cleartext exposure over the network, affecting that product/version. The connected documents do not provide exploit details or ...

CVE-2024-55541

CVE-2024-55541 is an XSS vulnerability affecting Acronis Cyber Protect 16 on Linux/Windows prior to build 39169, caused by missing origin validation in postMessage. The PT-2025-1146 report provides concrete details: vulnerable software and affected versions, and a remediation path—update to build...

CVE-2020-35664

CVE-2020-35664 : Multiple sources (NVD, Red Hat, CNVD, CVE lists) report an XSS vulnerability in Acronis Cyber Protect prior to 15 Update 1, build 26172, specifically in the console. The exact root cause, affected components, exploit methods, and remediation steps are not detailed in the provided...

CVE-2023-44154

CVE-2023-44154 affects Acronis Cyber Protect 15 (Linux and Windows) before build 35979. The issue is due to improper authorization, enabling sensitive information disclosure and manipulation. Documented impact includes disclosure and potential manipulation of data without sufficient privileges. T...

CVE-2022-45449

CVE-2022-45449 affects Acronis Cyber Protect 15 prior to build 30984. The root cause is excessive privileges granted to the Acronis Agent, enabling potential exposure of sensitive information. Impact: confidential data disclosure; remote attacker could access protected data if privileges are abus...

CVE-2023-44158

CVE-2023-44158 affects Acronis Cyber Protect 15 (Linux, Windows) prior to build 35979. The root cause is insufficient masking of the token field, leading to potential disclosure of sensitive information. The CVE entry indicates a high confidentiality impact but does not detail exploitability; exp...

CVE-2023-44156

CVE-2023-44156 affects Acronis Cyber Protect 15 (Linux, Windows) before build 35979. The root cause is spell-jacking, leading to sensitive information disclosure (confidential data exposed). The advisories in connected documents confirm the impact on data confidentiality and provide a remediation...

CVE-2024-49384

The CVE-2024-49384 issue affects Acronis Cyber Protect 16 (Linux and Windows) prior to build 38690, caused by the acep-collector service binding to an unrestricted IP address, creating an excessive attack surface. Technical details from PT-2024-33498 identify the vulnerable version range and root...

CVE-2021-38087

CVE-2021-38087 refers to a reflected XSS on the login page of Acronis Cyber Protect 15 prior to build 27009. The initial record lists the affected product/version and impact (XSS on login). Connected documents confirm remediation updates have been released (e.g., vulnerability fixes announced by ...

CVE-2022-24113

CVE-2022-24113 : Local privilege escalation due to excessive permissions assigned to child processes. Affects Windows versions of Acronis products listed in the CVE: Acronis Cyber Protect 15 (before 28035), Acronis Agent (before 27147), Acronis Cyber Protect Home Office (before 39612), and Acroni...

CVE-2023-41742

The CVE-2023-41742 issue affects Acronis Agent (Linux, macOS, Windows) prior to build 30430 and Acronis Cyber Protect 15 prior to build 35979. Root cause: binding to an unrestricted IP address, resulting in an excessive attack surface. Impact as described: CVSSv3 base score 7.5 (Network, High). R...

CVE-2021-44199

CVE-2021-44199 involves a DLL hijacking vulnerability that could cause a denial of service. Affected products (Windows): Acronis Cyber Protect 15 before build 28035 , Acronis Agent before build 27305 , and Acronis Cyber Protect Home Office before build 39612 . The provided documents confirm the v...

CVE-2021-44203

CVE-2021-44203 : A stored XSS vulnerability exists in Acronis Cyber Protect 15 (Windows, Linux) prior to build 28035. The issue stems from the web application’s lack of proper validation of client-side data in protection plan details, enabling execution of client-side code. Multiple sources corro...

CVE-2023-44160

CVE-2023-44160 describes a cross-site request forgery in Acronis Cyber Protect 15 (Linux and Windows) before build 35979 that leads to sensitive information manipulation. The connected sources corroborate the affected product and version range, with remediation guidance to update to build 35979 o...

CVE-2023-44206

Acronis Cyber Protect 15 (Linux/Windows) before build 35979 is affected by CVE-2023-44206. The root cause is an error in processing user-controlled authorization keys, allowing a remote attacker to elevate privileges, resulting in sensitive information disclosure and manipulation. The issue is fi...

CVE-2021-38088

Acronis Cyber Protect 15 for Windows prior to build 27009 is affected by CVE-2021-38088, which allows local privilege escalation via binary hijacking. The vulnerability affects the Windows build before 27009; up-to-date remediation is to upgrade to build 27009 or later. Exploitation details are n...

CVE-2022-45459

CVE-2022-45459 involves a vulnerability in Acronis Agent (Windows) and Acronis Cyber Protect 15 (Windows) caused by insecure registry permissions, enabling potential disclosure of sensitive information. Affected versions are Acronis Agent before build 30025 and Acronis Cyber Protect 15 before bui...

CVE-2023-41744

CVE-2023-41744 : Local privilege escalation due to unrestricted loading of unsigned libraries. Affected on macOS: Acronis Agent before build 30600, and Acronis Cyber Protect 15 before build 35979. Root cause: unsigned libraries loaded without restriction. Impact: local attacker could escalate pri...

CVE-2023-44155

CVE-2023-44155 affects Acronis Cyber Protect 15 prior to build 35979. The issue is a sensitive information leak via log files in the product. Affected platforms include Linux and Windows. Root cause details are not elaborated in the provided documents, but related sources consistently tie the vul...

CVE-2021-44200

CVE-2021-44200 affects Acronis Cyber Protect 15 (Windows and Linux) prior to build 28035. The vulnerability is a self cross-site scripting (XSS) issue on the devices page. The provided documents do not disclose the exact underlying root cause or exploitation details beyond the XSS description. A ...

CVE-2023-44159

CVE-2023-44159 affects Acronis Cyber Protect 15 (Linux and Windows) prior to build 35979. The root cause is cleartext storage of sensitive information, which enables disclosure of sensitive data. Reported remediation is to upgrade to a version that includes the security fix, i.e., build 35979 or ...

CVE-2023-44152

CVE-2023-44152 affects Acronis Cyber Protect 15 prior to build 35979. The root cause is improper authentication, enabling disclosure and manipulation of sensitive information. Impact is described as sensitive information disclosure and manipulation with no exploitation specifics provided beyond t...

CVE-2022-45458

CVE-2022-45458 affects Acronis Agent (Windows/macOS/Linux) prior to build 29633 and Acronis Cyber Protect 15 prior to build 30984. The issue arises from improper certification validation, enabling sensitive information disclosure (and manipulation) with no user interaction. Acronis lists the fix ...

CVE-2023-44157

CVE-2023-44157 affects Acronis Cyber Protect 15 (Windows) prior to build 35979. The root cause is insecure folder permissions enabling local privilege escalation. The NVD/CVEs describe a Local Privilege Escalation with high impact on confidentiality, integrity, and availability, and there is no p...

CVE-2021-44198

CVE-2021-44198 affects Acronis Cyber Protect 15 on Windows prior to build 28035, with the issue described as a DLL hijacking vulnerability that enables local privilege escalation. The connected sources corroborate DLL hijacking as the root cause and specify the affected product and affected build...