Insufficient authorization checks allow an attacker to modify configuration settings in Acronis Cyber Protect 17 builds before 41186 on Linux and Windows. An attacker could alter security-related parameters, potentially weakening protection or creating a foothold for further compromise. The vulnerability is classified as a CWE-863 (Authorization Bypass through User‑Controlled Input).

Acronis Cyber Protect 17 on Linux and Windows, any installation built before version 41186.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or remote access to the configuration interface, though the exact prerequisites are not explicitly documented; it is inferred that the attacker must gain some level of access to the protected settings subsystem.