Credentials are not deleted from Acronis Agent after plan revocation.

Acronis Cyber Protect Cloud Agent · Incorrect permissions · CWE-732

AffectedAcronis Cyber Protect Cloud Agent

FixUpdate to 41124 or newer

PublishedMar 5, 23:47 · Acronis

ScoredMar 5 · 4.4 · Acronis

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:05 UTC

What we know

No known exploitation. CISA KEV, checked 22:05 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs local access to the machine. CVSS: local.

A successful attack can read data. CVSS impact.

Description

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.

From Acronis

Affected and fixed versions

ProductAffectedFixed inAcronis Cyber Protect Cloud Agentunspecified – before 4112441124

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

SEC-9386 · security-advisory.acronis.comvendor advisory SEC-8658 · security-advisory.acronis.comrelated

Other CVEs in Acronis Cyber Protect Cloud Agent

All 37 →

7.1Local privilege escalation due to improper authentication. · CVE-2025-30414Oct 28 4.4Credentials are not deleted from Acronis Agent after plan revocation. · CVE-2025-30413Mar 5 7.1Default credentials set for local privileged user in Virtual Appliance. · CVE-2026-28713Mar 5