Backup and recovery
Acronis advisories: every record the registers tie to its products
In one line
54 advisories are attributed to Acronis products in this record, covering August 2023 to June 2026, and 1 of them appears in the CISA catalogue of known exploited vulnerabilities. A further 1 register entry mentions Acronis without naming one of its products as affected, and is excluded rather than counted. Each entry below links to the register that published it.
Attributed
54
tied to a named product
Known exploited
1
in the CISA catalogue
Rated critical
1
by the register
Last checked
Jul 24, 2026
sources re-queried
Why this list is shorter than a CVE mirror
The registers are searched by keyword, so a search for a company name returns advisories that merely mention it. A mirror publishes those. This page does not: an entry appears only when the register itself ties it to a product of Acronis, through a reference on the vendor's own domain, the vendor named as the assigning authority, or the affected product list naming it.
1 entry did not clear that bar and is not shown. That is the difference, and it is deliberate: a page that lists another company's vulnerability under this heading is wrong in the way that matters most.
53 of the 54 records carry a CVSS base score from the register. Where none is published, none is shown, and no score is estimated.
The full list, most recently exploited and most recent first
Records held by several registers are folded into one entry with a link to each, so the same vulnerability is not counted twice. Entries listed in the CISA catalogue of known exploited vulnerabilities are shown first, because that is the one flag on this page that changes what a reader should do next.
- CVE-2023-45249criticalKnown exploitedJul 29, 2024
Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability
- CVE-2026-44682highCVSS 7.3Jun 03, 2026
Local privilege escalation due to DLL hijacking vulnerability.
- CVE-2026-42061highCVSS 7.3Jun 03, 2026
Local privilege escalation due to excessive permissions assigned to child processes.
- CVE-2026-50033highCVSS 7.3Jun 03, 2026
Local privilege escalation due to DLL hijacking vulnerability.
- CVE-2026-44609highCVSS 7.3Jun 03, 2026
Local privilege escalation due to EXE hijacking vulnerability.
- WID-SEC-2026-1322highCVSS 9.9Apr 30, 2026
Affected products: Acronis Cyber Protect
- CVE-2026-41220highCVSS 7.8Apr 29, 2026
Local privilege escalation due to improper input validation.
- CVE-2026-41952highCVSS 7.8Apr 29, 2026
Local privilege escalation due to improper input validation.
- CVE-2026-25852mediumCVSS 6.7Apr 29, 2026
Local privilege escalation due to DLL hijacking vulnerability.
- CVE-2026-33092highCVSS 7.8Apr 10, 2026
Local privilege escalation due to improper handling of environment variables.
- CVE-2026-33271mediumCVSS 6.7Apr 02, 2026
Local privilege escalation due to insecure folder permissions.
- CVE-2026-27774mediumCVSS 6.7Apr 02, 2026
Local privilege escalation due to DLL hijacking vulnerability.
- CVE-2026-28728mediumCVSS 6.7Apr 02, 2026
Local privilege escalation due to DLL hijacking vulnerability.
- WID-SEC-2026-0620highCVSS 8.1Mar 06, 2026
Affected products: Acronis Cyber Protect
- WID-SEC-2025-1690lowCVSS 4.4Mar 06, 2026
Affected products: Acronis Cyber Protect
- CVE-2026-28719mediumCVSS 4.3Mar 05, 2026
Unauthorized resource manipulation due to improper authorization checks.
- CVE-2026-28718mediumCVSS 5.3Mar 05, 2026
Denial of service due to insufficient input validation in authentication logging.
- CVE-2026-28716mediumCVSS 4.4Mar 05, 2026
Information disclosure and manipulation due to improper authorization checks.
- CVE-2026-28715mediumCVSS 6.5Mar 05, 2026
Sensitive information disclosure due to improper authorization checks.
- CVE-2026-28714mediumCVSS 4.8Mar 05, 2026
Unnecessary transmission of sensitive cryptographic material.
- CVE-2026-28727highCVSS 7.8Mar 05, 2026
Local privilege escalation due to insecure Unix socket permissions.
- CVE-2025-7779highCVSS 8.8Sep 30, 2025
Local privilege escalation due to insecure XPC service configuration.
- CVE-2025-11178highCVSS 7.3Sep 30, 2025
Local privilege escalation due to DLL hijacking vulnerability.
- WID-SEC-2025-1924mediumCVSS 7.8Aug 29, 2025
Affected products: Acronis Cyber Protect
- WID-SEC-2025-1610mediumCVSS 7.3Aug 29, 2025
Affected products: Acronis Cyber Protect
- WID-SEC-2025-1249highCVSS 10.0Jun 05, 2025
Affected products: Acronis Cyber Protect
- CVE-2025-30415highCVSS 7.5Jun 04, 2025
Denial of service due to improper handling of malformed input.
- WID-SEC-2025-1199mediumCVSS 7.5May 30, 2025
Affected products: Acronis Cyber Protect
- WID-SEC-2025-0884mediumCVSS 6.7Apr 25, 2025
Affected products: Acronis Cyber Protect
- WID-SEC-2025-0642mediumCVSS 6.3Mar 27, 2025
Affected products: Acronis Cyber Protect
- WID-SEC-2025-0447mediumCVSS 7.3Feb 27, 2025
Affected products: Acronis Cyber Protect
- WID-SEC-2025-0248mediumCVSS 6.6Feb 03, 2025
Affected products: Acronis Cyber Protect
- WID-SEC-2025-0005mediumCVSS 7.3Jan 03, 2025
Affected products: Acronis Cyber Protect
- CVE-2024-49385mediumCVSS 5.5Jan 02, 2025
Sensitive information disclosure due to insecure folder permissions.
- CVE-2024-55538mediumCVSS 4.0Jan 02, 2025
Sensitive information disclosure due to missing authentication.
- WID-SEC-2024-3747lowCVSS 2.5Dec 24, 2024
Affected products: Acronis Cyber Protect
- WID-SEC-2024-3568mediumCVSS 7.3Dec 02, 2024
Affected products: Acronis Cyber Protect
- WID-SEC-2024-0657mediumCVSS 7.3Nov 25, 2024
Affected products: Acronis Cyber Protect
- WID-SEC-2024-3400mediumCVSS 5.5Nov 12, 2024
Affected products: Acronis Cyber Backup
- WID-SEC-2024-3181mediumCVSS 5.4Oct 15, 2024
Affected products: Acronis Cyber Protect
- CVE-2024-34013highCVSS 7.8Jul 18, 2024
Local privilege escalation due to OS command injection vulnerability.
- WID-SEC-2024-0996highCVSS 8.2Apr 30, 2024
Affected products: Acronis Cyber Protect
- CVE-2024-34010highCVSS 8.2Apr 29, 2024
Local privilege escalation due to unquoted search path vulnerability.
- WID-SEC-2024-0493mediumCVSS 7.3Feb 28, 2024
Affected products: Acronis Cyber Protect
- WID-SEC-2023-3157lowCVSS 3.3Dec 15, 2023
Affected products: Acronis Cyber Protect
- WID-SEC-2023-3109mediumCVSS 7.3Dec 12, 2023
Affected products: Acronis Cyber Protect
- CVE-2023-48677highCVSS 7.3Dec 12, 2023
Local privilege escalation due to DLL hijacking vulnerability.
- WID-SEC-2023-2966lowCVSS 3.3Nov 20, 2023
Affected products: Acronis Cyber Protect
- WID-SEC-2023-2582mediumCVSS 7.3Oct 06, 2023
Affected products: Acronis Cyber Protect
- WID-SEC-2023-2563mediumCVSS 7.8Oct 05, 2023
Affected products: Acronis Cyber Protect Home Office
- CVE-2023-44208highCVSS 7.8Oct 04, 2023
Sensitive information disclosure and manipulation due to missing authorization.
- CVE-2023-5042mediumCVSS 5.5Sep 20, 2023
Sensitive information disclosure due to insecure folder permissions.
- CVE-2022-46869highCVSS 7.3Aug 31, 2023
Local privilege escalation during installation due to improper soft link handling.
- CVE-2023-41743highCVSS 8.8Aug 31, 2023
Local privilege escalation due to insecure driver communication port permissions.
Which registers contributed
| Register | Operated by | Entries | Latest |
|---|---|---|---|
| European Vulnerability Database | ENISA, European Union | 29 | Jun 03, 2026 |
| CERT-Bund security advisories | BSI, Federal Republic of Germany | 25 | Apr 30, 2026 |
| Known Exploited Vulnerabilities catalogue | CISA, United States | 1 | Jul 29, 2024 |
The entry counts here are the raw register totals for Acronis, before attribution. They are larger than the list above for exactly that reason.
Questions this page answers
How many vulnerabilities does Acronis have?
54 advisories in this record are tied by a register to a product of Acronis. That is not the same as the number of vulnerabilities the products contain, and no public source knows that number. It is the count of what has been found, disclosed and published, which depends on how much the products are examined and how openly the vendor discloses.
Are any Acronis vulnerabilities being actively exploited?
1 of the 54 records here appears in the CISA catalogue of known exploited vulnerabilities, which lists flaws with confirmed exploitation in the wild. They are shown first in the list above. Whether any of them affects your deployment depends on the versions and components you run.
Why does this page show fewer CVEs for Acronis than other sites?
Because a keyword search for a company name returns advisories about other companies' products that mention it in passing, and this page excludes those. 1 register entry names Acronis without naming one of its products as affected. A mirror that lists them produces a longer page and a wrong number.
Where do the Acronis advisories on this page come from?
From European Vulnerability Database (ENISA, European Union); CERT-Bund security advisories (BSI, Federal Republic of Germany); Known Exploited Vulnerabilities catalogue (CISA, United States). Every entry links back to the register that published it, and carries the date that register states. Where the same vulnerability is held by several registers it is shown once with a link to each, rather than counted twice.
Does a long advisory list mean Acronis is insecure?
No. A register records what researchers found and what the vendor disclosed, so a widely deployed product with a working disclosure process accumulates more entries than one nobody examines. A short list can equally mean a small install base or a vendor that publishes little. This page reports the record and does not rate the vendor, because whether this is acceptable depends on your risk appetite, your compliance scope and the alternatives you are weighing.
A list of advisories is not a risk assessment
What matters is which of these touch the components you actually run, in the configuration you actually run them in, and whether that is acceptable next to the alternatives on your shortlist. DecisionOS reads the same pool against the criteria of a real decision and produces a memo that holds up in front of a board and an auditor.
The full Acronis record, including sources and open questions