Acronis Cyber Infrastructure vulnerabilities

3 CVEs affecting Acronis Cyber Infrastructure, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-45249, published 2024-07-24.

More from Acronis.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-45249: Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability, published 2024-07-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-07-29. EPSS: 53.3% chance of exploitation in the next 30 days. Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before…
• CVE-2023-2360, published 2023-04-28. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.2.0-135.
• CVE-2023-2782, published 2023-05-18. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.3.1-38.