The vulnerability is caused by a protection mechanism failure stemming from missing binary hardening in the Linux executables of Acronis Cyber Protect 17. Classified as CWE-693, the flaw means the binaries lack essential low‑level defenses such as stack canaries, NX, or address space layout randomization, which weakens the application’s ability to guard against memory corruption attacks. While this does not automatically grant arbitrary code execution, it permits an attacker who can inject or manipulate data to bypass application security checks or cause unintended behavior, thereby compromising the integrity and confidentiality of protected resources.

This issue affects all Linux builds of Acronis Cyber Protect 17 prior to build 42587. The advisory does not list any other products or versions, so only systems running those vulnerable builds are at risk.

The CVSS score of 3.6 indicates a low severity, and the absence of an EPSS value combined with the vulnerability not being in the CISA KEV catalog suggests limited exploitation evidence and a relatively modest likelihood of real‑world attacks. The known attack vector appears to be exploitation of the unprotected binaries, likely requiring local access or prior compromise to achieve memory corruption; remote exploitation is not explicitly documented.