Credentials are not deleted from Acronis Agent after plan revocation.

Acronis Cyber Protect Cloud Agent · Incorrect permissions · CWE-732

AffectedAcronis Cyber Protect Cloud Agent, Acronis Cyber Protect 17

FixUpdate to 40497, 41186 or newer

PublishedMar 5, 23:56 · Acronis

ScoredMar 5 · 4.4 · Acronis

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:05 UTC

What we know

No known exploitation. CISA KEV, checked 22:05 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker needs local access to the machine. CVSS: local.

A successful attack can read data. CVSS impact.

Description

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.

From Acronis

Affected and fixed versions

ProductAffectedFixed inAcronis Cyber Protect Cloud Agentunspecified – before 4049740497Acronis Cyber Protect 17unspecified – before 4118641186

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

SEC-8658 · security-advisory.acronis.comvendor advisory SEC-9386 · security-advisory.acronis.comrelated

Other CVEs in Acronis Cyber Protect Cloud Agent

All 37 →

7.1Local privilege escalation due to improper authentication. · CVE-2025-30414Oct 28 7.1Default credentials set for local privileged user in Virtual Appliance. · CVE-2026-28713Mar 5 4.4Credentials are not deleted from Acronis Agent after plan revocation. · CVE-2025-11790Mar 5