CVE-2026-28724

Executive Summary

CVE-2026-28724 is a medium-severity vulnerability in Acronis Cyber Protect 17 (Linux and Windows) affecting builds prior to 41186. The flaw stems from insufficient access control validation, allowing unauthorized data access. With a CVSS score of 4.3 and an EPSS probability of 0.0%, exploitation is currently not widespread, but the lack of a public patch status (UNKNOWN/UNPATCHED) raises concerns for organizations relying on this product. The vulnerability is network-exploitable with low complexity and no authentication required, making it a potential vector for data exfiltration in exposed deployments.

Supply Chain & Package Security

This vulnerability does not affect open-source package ecosystems (NPM, PyPI, Go, Ruby). It is specific to the proprietary Acronis Cyber Protect 17 software, which is distributed as a binary product. Organizations should verify the integrity of their Acronis installation files and ensure they are sourced from official channels.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized data access but does not enable code execution or denial of service. The low EPSS score (0.0%) suggests active exploitation is rare, but the lack of a confirmed patch status increases risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability resides in the access control mechanism of Acronis Cyber Protect 17. Insufficient validation of user permissions or session tokens allows an unauthenticated attacker to access protected data. The exact attack vector is not publicly documented, but based on the CWE (CWE-284: Improper Access Control), it likely involves:

• Bypassing authentication checks via crafted API requests.
• Exploiting missing authorization checks on specific endpoints.
• Leveraging default or weak access controls in the web management interface.

The affected component is the core management service, which handles data backup and recovery operations. An attacker could enumerate or read backup metadata, configuration files, or potentially sensitive data stored in backups.

Vulnerable vs. Patched Code

No specific code diff is publicly available. However, the patch (build 41186) likely introduces:

• Vulnerable: Missing or weak access control checks on API endpoints (e.g., /api/backup/list, /api/config/get).
• Patched: Implementation of proper authentication and authorization middleware, validating session tokens or API keys before processing requests.

Example (Hypothetical):

# Vulnerable code (pre-build 41186)
@app.route('/api/backup/list')
def list_backups():
    # No authentication check
    return jsonify(get_all_backups())

# Patched code (build 41186+)
@app.route('/api/backup/list')
@require_auth
def list_backups():
    # Authentication required
    return jsonify(get_all_backups())

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Acronis Cyber Protect 17 (build < 41186) on Linux or Windows.
• Network access to the management interface (default ports: 443, 8443, or 9877).

Exploitation Steps:

1. Reconnaissance: Scan for Acronis Cyber Protect instances using Shodan or Nmap.

   nmap -p 443,8443,9877 --script http-title <target>
   

2. Identify Endpoints: Use a web fuzzer to discover API endpoints.

   ffuf -u https://<target>/api/FUZZ -w /usr/share/wordlists/api_endpoints.txt
   

3. Exploit: Send a direct request to a sensitive endpoint without authentication.

   curl -k https://<target>/api/backup/list
   

   If successful, the response will contain backup metadata or data.

Note: No public exploit code is available. This is a theoretical exploitation path based on CWE-284.

Blue Team

Detection:

• Monitor for unauthorized access to API endpoints (e.g., /api/backup/list, /api/config/get).
• Alert on HTTP 200 responses to unauthenticated requests to sensitive paths.
• Use the Sigma rule below to detect anomalous access patterns.

Hunting:

• Search logs for requests to /api/ without a valid session cookie or Authorization header.
• Correlate with failed authentication attempts (HTTP 401/403) followed by successful access (HTTP 200).

Indicators of Compromise (IOCs)

• Network:
  • Unauthenticated HTTP requests to /api/backup/list, /api/config/get, or similar endpoints.
  • Source IPs performing directory brute-forcing on Acronis management interfaces.
• Host:
  • Unusual access to Acronis configuration files (e.g., /etc/acronis/, C:\ProgramData\Acronis\).
  • Unexpected outbound connections from the Acronis service to external IPs.
• Logs:
  • Web server logs showing GET /api/backup/list with HTTP 200 and no Authorization header.
  • Application logs with "Access denied" followed by "Access granted" for the same user.

Detection Engineering

YARA Rule

rule CVE_2026_28724_Acronis_Access_Control {
    meta:
        description = "Detects potential exploitation of CVE-2026-28724 in Acronis Cyber Protect logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-28724"
    strings:
        $s1 = "/api/backup/list" ascii wide nocase
        $s2 = "/api/config/get" ascii wide nocase
        $s3 = "HTTP/1.1 200 OK" ascii wide
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: Unauthenticated Access to Acronis API Endpoints
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated HTTP requests to sensitive Acronis Cyber Protect API endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/api/backup/list'
            - '/api/config/get'
            - '/api/backup/download'
        sc-status: 200
    filter:
        cs-host: 'localhost'
    condition: selection and not filter
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-28724 - Unauthenticated Acronis API Access";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/backup/list"; http_uri;
    content:"!Authorization"; http_header;
    sid:1000001;
    rev:1;
    reference:cve,2026-28724;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

1. Immediate Action: Upgrade to Acronis Cyber Protect 17 build 41186 or later. Contact Acronis support for patch availability if not yet released.
2. Workaround: Restrict network access to the Acronis management interface using firewall rules. Only allow trusted IPs.
3. Configuration: Enable multi-factor authentication (MFA) and enforce strong session management.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.
5. Validation: After patching, verify the fix by attempting unauthenticated access to API endpoints.

Valters IT – Securing your digital frontier.