Acronis Cyber Backup vulnerabilities

4 CVEs affecting Acronis Cyber Backup, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-3405, published 2023-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-16171, published 2020-09-21. Medium severity, CVSS 6.5. EPSS: 5.5% chance of exploitation in the next 30 days. An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. Some API endpoints on port 9877 under /api/ams/ accept an additional custom Shard header. The value of this header is…
CVE-2022-3405, published 2023-05-03. High severity, CVSS 8.8. EPSS: 5.3% chance of exploitation in the next 30 days. Code execution and sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build…
CVE-2022-30995, published 2023-05-03. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Sensitive information disclosure due to improper authentication. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 29486, Acronis Cyber Backup 12.5 (Windows,…
CVE-2020-10138, published 2020-10-21. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect…