CP
Product
Cyber Protect
86
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 7High 41Medium 38Low 0
Watch
Add Cyber Protect to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44161 | 6.5 | Sep 27 | Sensitive information manipulation due to cross-site request forgery Affected: before 15; 15; 15; 15; 15; 15; +1 more |
| CVE-2023-44160 | 6.5 | Sep 27 | Sensitive information manipulation due to cross-site request forgery Affected: before 15; 15; 15; 15; 15; 15; +1 more |
| CVE-2026-28712 | 6.3 | Mar 5 | Local privilege escalation due to DLL hijacking vulnerability Affected: before 17.0.41186 |
| CVE-2026-28711 | 6.3 | Mar 5 | Local privilege escalation due to DLL hijacking vulnerability Affected: before 17.0.41186 |
| CVE-2024-55541 | 6.1 | Jan 2 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage Affected: through 15; 16; 16; 16 |
| CVE-2023-48681 | 6.1 | Feb 27 | Self cross-site scripting (XSS) vulnerability in storage nodes search field Affected: before 16 |
| CVE-2022-30992 | 6.1 | May 18 | Open redirect via user-controlled query parameter Affected: before 15; 15; 15; 15; 15 |
| CVE-2022-30991 | 6.1 | May 18 | HTML injection via report name Affected: before 15; 15; 15; 15; 15 |
| CVE-2021-44201 | 6.1 | Nov 29 | Cross-site scripting (XSS) was possible in notification pop-ups Affected: before 15; 15; 15; 15 |
| CVE-2021-38087 | 6.1 | Aug 12 | Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009 Affected: before 15; 15; 15 |
| CVE-2020-35664 | 6.1 | Feb 22 | An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172 Affected: before 15; 15 |
| CVE-2026-28725 | 5.5 | Mar 5 | Sensitive information disclosure due to improper configuration of a headless browser Affected: before 17.0.41186 |
| CVE-2023-48680 | 5.5 | Feb 27 | Sensitive information disclosure due to excessive collection of system information Affected: before 16 |
| CVE-2023-48678 | 5.5 | Feb 27 | Sensitive information disclosure due to insecure folder permissions Affected: before 16 |
| CVE-2023-41745 | 5.5 | Aug 31 | Sensitive information disclosure due to excessive collection of system information Affected: 15; 15; 15; 15; 15; 15 |
| CVE-2021-44199 | 5.5 | Nov 29 | DLL hijacking could lead to denial of service Affected: before 15; 15; 15; 15 |
| CVE-2023-48682 | 5.4 | Feb 27 | Stored cross-site scripting (XSS) vulnerability in unit name Affected: before 16 |
| CVE-2023-48679 | 5.4 | Feb 27 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage Affected: before 16 |
| CVE-2023-44207 | 5.4 | Sep 27 | Stored cross-site scripting (XSS) vulnerability in protection plan name Affected: before 15; 15; 15; 15; 15; 15; +1 more |
| CVE-2021-44203 | 5.4 | Nov 29 | Stored cross-site scripting (XSS) was possible in protection plan details Affected: before 15; 15; 15; 15 |
| CVE-2021-44202 | 5.4 | Nov 29 | Stored cross-site scripting (XSS) was possible in activity details Affected: before 15; 15; 15; 15 |
| CVE-2021-44200 | 5.4 | Nov 29 | Self cross-site scripting (XSS) was possible on devices page Affected: before 15; 15; 15; 15 |
| CVE-2023-44205 | 5.3 | Sep 27 | Sensitive information disclosure due to improper authorization Affected: before 15; 15; 15; 15; 15; 15; +1 more |
| CVE-2026-28717 | 5.0 | Mar 5 | Local privilege escalation due to improper directory permissions Affected: before 17.0.41186 |
| CVE-2026-28714 | 4.8 | Mar 5 | Unnecessary transmission of sensitive cryptographic material Affected: before 17.0.41186 |
| CVE-2025-30413 | 4.4 | Mar 5 | Credentials are not deleted from Acronis Agent after plan revocation Affected: before 17.0.41186 |
| CVE-2026-28716 | 4.4 | Mar 5 | Information disclosure and manipulation due to improper authorization checks Affected: before 17.0.41186 |
| CVE-2026-28726 | 4.3 | Mar 5 | Sensitive information disclosure due to improper access control Affected: before 17.0.41186 |
| CVE-2026-28724 | 4.3 | Mar 5 | Unauthorized data access due to insufficient access control validation Affected: before 17.0.41186 |
| CVE-2026-28723 | 4.3 | Mar 5 | Unauthorized report deletion due to insufficient access control Affected: before 17.0.41186 |
| CVE-2026-28720 | 4.3 | Mar 5 | Unauthorized modification of settings due to insufficient authorization checks Affected: before 17.0.41186 |
| CVE-2026-28719 | 4.3 | Mar 5 | Unauthorized resource manipulation due to improper authorization checks Affected: before 17.0.41186 |
| CVE-2026-28709 | 4.3 | Mar 5 | Unauthorized resource manipulation due to improper authorization checks Affected: before 17.0.41186 |
| CVE-2024-49384 | 4.3 | Oct 15 | Excessive attack surface in acep-collector service due to binding to an unrestricted IP address Affected: through 15; 16; 16 |
| CVE-2024-49383 | 4.3 | Oct 15 | Excessive attack surface in acep-importer service due to binding to an unrestricted IP address Affected: through 15; 16; 16 |
| CVE-2024-49382 | 4.3 | Oct 15 | Excessive attack surface in archive-server service due to binding to an unrestricted IP address Affected: through 15; 16; 16 |