Critical severity · published Feb 20, 2026
CVE-2025-30410
Sensitive data disclosure and manipulation due to missing authentication
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 41800.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Acronis Cyber Protect 15 · Acronis
before 41800 · source: vendor
AC
Acronis Cyber Protect 16 · Acronis
before 39938 · source: vendor
AC
Acronis Cyber Protect Cloud Agent · Acronis
before 39870 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30410
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30410
security-advisory.acronis.com
https://security-advisory.acronis.com/advisories/SEC-8641
More from Acronis Cyber Protect 15
10.0
CVE-2025-30416
Sensitive data disclosure and manipulation due to missing authorization
10.0
CVE-2025-30412
Sensitive data disclosure and manipulation due to improper authentication
10.0
CVE-2025-30411
Sensitive data disclosure and manipulation due to improper authentication