Cross-Site Scripting Vulnerability in Acronis Cyber Protect by Acronis
CVE-2026-87099

5.7MEDIUM

Key Information:

Vendor

Acronis
Status
Acronis Cyber Protect 17
Vendor
CVE Published:
28 October 2026

What is CVE-2026-87099?

Acronis Cyber Protect 17 is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper input validation. This allows attackers to inject malicious scripts into web pages that can run when users access affected areas of the service. Users of Acronis Cyber Protect 17 on both Linux and Windows platforms must ensure they are on build 42587 or later to mitigate this risk. For detailed information, refer to the vendor advisory at SEC-8835.

Affected Version(s)

Acronis Cyber Protect 17 Linux < 42587

References

https://security-advisory.acronis.com/advisories/SEC-8835
vendor-advisory

CVSS V3.0

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@mad31k (https://hackerone.com/mad31k)
.