Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyb

The core of this vulnerability lies in the absence of proper authentication checks. An attacker who can exploit this flaw could potentially gain access to sensitive data stored or processed by the Acronis Cyber Protect Cloud Agent. This includes backup data, system configurations, and potentially even credentials. The ability to manipulate data introduces a further risk, allowing attackers to corrupt backups, alter system settings, or even inject malicious code. The impact is particularly severe given the nature of Acronis's product – data protection – making this a significant compromise of trust. Successful exploitation could lead to data breaches, ransomware attacks, and significant disruption of business operations.

Organizations heavily reliant on Acronis Cyber Protect Cloud Agent for data backup and recovery are particularly at risk. This includes businesses with sensitive data subject to regulatory compliance (e.g., HIPAA, GDPR). Shared hosting environments where multiple users share the same Acronis agent instance are also at increased risk, as a compromise of one user could potentially expose data for others.

• linux / server:

journalctl -u acronis-agent -g 'authentication failure'

• windows:

Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4625]]" -ErrorAction SilentlyContinue

• generic web: Check Acronis agent endpoints for lack of authentication using curl -I <agent_endpoint> and verify that authentication is required for all sensitive operations.

1. 2026-02-20Disclosure

   disclosure

1. Reserviert2025-03-21
2. Veröffentlicht2026-02-20
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-30410 is to upgrade Acronis Cyber Protect Cloud Agent to build 41800 or later. If an immediate upgrade is not feasible due to compatibility issues or downtime constraints, consider implementing stricter network segmentation to limit access to the agent. Review firewall rules to ensure only authorized systems can communicate with the agent. While not a complete solution, restricting access can reduce the attack surface. Monitor system logs for unusual activity, specifically looking for unauthorized access attempts or data modification events. After upgrading, verify the fix by attempting to access agent functionalities without proper authentication credentials and confirming access is denied.