CVE-2026-28726 reveals an improper access control flaw that permits sensitive data disclosure in Acronis Cyber Protect 17. The weakness allows unauthenticated or misprivileged users to read confidential information that should otherwise be protected, thereby compromising confidentiality and reflecting the vulnerability type CWE‑863.

This vulnerability affects Acronis Cyber Protect 17 running on Linux or Windows platforms, specifically builds prior to 41186. Any system with an older build is potentially exploitable.

The CVSS score of 4.3 denotes a medium severity for confidentiality impact, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The advisory notes that the vulnerability is not listed in the CISA KEV catalog. Because the description does not specify an attack vector, the threat could be local or remote depending on how the affected system exposes the vulnerable functionality.