The vulnerability is caused by insufficient input validation in authentication logging, allowing an attacker to inject malformed data that can exhaust resources or crash the logging process. This leads to a denial of service, interrupting the authentication service and causing temporary unavailability for users. No evidence of code execution or data compromise is provided.

The affected product is Acronis Cyber Protect 17 on Linux and Windows platforms. Any build prior to 41186 is vulnerable; builds 41186 and later include the fix.

The CVSS score of 7.5 indicates a moderate to high severity level. The EPSS score is below 1%, indicating a low probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker could craft authentication requests containing malicious payloads targeting the logging component, potentially causing the service to become unavailable. The DoS impact is limited to the authentication subsystem but can disrupt overall system access.