Credential Management Flaw in Acronis Cyber Protect Cloud Agent by Acronis
CVE-2025-11790

4.4MEDIUM

Key Information:

Vendor

Acronis
Status
Acronis Cyber Protect Cloud Agent
Vendor
CVE Published:
5 March 2026

What is CVE-2025-11790?

Acronis Cyber Protect Cloud Agent versions prior to build 41124 fail to securely delete user credentials post plan revocation. This oversight can potentially expose sensitive information, risking unauthorized access to data and system resources. It's essential for users to be aware of this vulnerability to take appropriate measures.

Affected Version(s)

Acronis Cyber Protect Cloud Agent Linux < 41124

References

https://security-advisory.acronis.com/advisories/SEC-9386
vendor-advisory
https://security-advisory.acronis.com/SEC-8658
related

CVSS V3.0

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Airbus SecLab (mailto:vuln@airbus.com)
Quentin Liddell (mailto:vuln@airbus.com)
Mattéo Ricordeau (mailto:vuln@airbus.com)
Benoît Camredon (mailto:vuln@airbus.com)
.