CVE-2026-87096 Acronis CVE debrief

Who should care

Defenders and administrators responsible for Acronis Cyber Infrastructure (ACI) deployments should assess exposure and apply necessary updates to prevent potential information disclosure and manipulation.

Why it matters

CVE-2026-87096 is a low-severity vulnerability affecting Acronis Cyber Infrastructure (ACI) versions before 6.0.1-112, 6.1.1-64, and 6.2.1-71, allowing sensitive information disclosure and manipulation due to improper authorization checks. Defenders and administrators responsible for ACI deployments should assess exposure and apply necessary updates to prevent potential information disclosure and manipulation.

• Verification of ACI versions and application of vendor-provided updates is necessary to prevent potential information disclosure and manipulation.
• Defenders should review and enhance authorization checks and configurations for ACI deployments to minimize the risk of exploitation.
• Monitoring ACI systems for potential information disclosure and manipulation attempts is crucial to detect and respond to potential security incidents.

Technical summary

The vulnerability, CVE-2026-87096, is caused by improper authorization checks in Acronis Cyber Infrastructure (ACI) versions before 6.0.1-112, 6.1.1-64, and 6.2.1-71, allowing for sensitive information disclosure and manipulation. The vulnerability has a CVSS score of 3.3 and is considered low-severity. Defenders should prioritize verifying ACI versions and applying vendor-provided updates to prevent potential information disclosure and manipulation. The CVE record and vendor advisory provide details on the affected ACI versions and the nature of the vulnerability.

Defensive priority

Defenders should prioritize verifying ACI versions and applying vendor-provided updates to prevent potential information disclosure and manipulation.

Recommended defensive actions

• Verify ACI versions and apply updates to ensure versions 6.0.1-112, 6.1.1-64, or 6.2.1-71 or later are deployed.
• Review and enhance authorization checks and configurations for ACI deployments.
• Monitor ACI systems for potential information disclosure and manipulation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and vendor advisory provide details on the affected ACI versions and the nature of the vulnerability. The CVE record was published on 2026-10-21T10:14:44.298Z and has not been modified since then. The vendor advisory SEC-8129 provides additional information on the vulnerability. The information available suggests that the vulnerability is caused by improper authorization checks in ACI versions before 6.0.1-112, 6.1.1-64, and 6.2.1-71.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.