Description
Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Published: 2026-03-05
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Leakage of Sensitive Cryptographic Material
Action: Patch
AI Analysis

Impact

The vulnerability allows the unnecessary transmission of cryptographic material, potentially exposing keys or certificates used by Acronis Cyber Protect 17. This can lead to confidentiality compromise of encryption assets and is classified as CWE‑522, authentication material exposure.

Affected Systems

Acronis Cyber Protect 17 running on Linux and Windows systems with builds older than 41186 are affected.

Risk and Exploitability

The CVSS score of 4.8 indicates a medium risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require attacker access to the agent or server configuration to trigger the transmission; the advisement does not specify additional conditions.

Generated by OpenCVE AI on April 16, 2026 at 11:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Acronis Cyber Protect to build 41186 or later where the issue is fixed.
  • Restrict outbound traffic from the Acronis components to prevent unintended transmission of cryptographic material to unauthorized destinations.
  • Consult the Acronis advisory at https://security-advisory.acronis.com/advisories/SEC-5383 for additional guidance and monitor for future patches.

Generated by OpenCVE AI on April 16, 2026 at 11:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 16 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unnecessary Transmission of Sensitive Cryptographic Material in Acronis Cyber Protect 17

Fri, 13 Mar 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Acronis cyber Protect
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:acronis:cyber_protect:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Acronis cyber Protect
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Mon, 09 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Acronis
Acronis acronis Cyber Protect 17
Vendors & Products Acronis
Acronis acronis Cyber Protect 17

Fri, 06 Mar 2026 00:00:00 +0000

Type Values Removed Values Added
Description Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Weaknesses CWE-522
References
Metrics cvssV3_0

{'score': 4.8, 'vector': 'CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Subscriptions

Acronis Acronis Cyber Protect 17 Cyber Protect
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Acronis

Published:

Updated: 2026-03-09T17:19:55.828Z

Reserved: 2026-03-03T02:29:03.753Z

Link: CVE-2026-28714

cve-icon Vulnrichment

Updated: 2026-03-09T17:19:52.505Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-06T00:16:11.900

Modified: 2026-03-13T16:39:21.643

Link: CVE-2026-28714

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T12:00:11Z

Weaknesses