Acronis Cyber Files vulnerabilities

5 CVEs affecting Acronis Cyber Files, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-49392, published 2024-10-17.

More from Acronis.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-49386, published 2024-10-17. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
• CVE-2024-49392, published 2024-10-17. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
• CVE-2024-49390, published 2024-10-17. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
• CVE-2024-49391, published 2024-10-17. High severity, CVSS 7.3. EPSS: 0.1% chance of exploitation in the next 30 days. Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.
• CVE-2024-49389, published 2024-10-17. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.