FAIL › dossier
Acronis
VENDOR· dossier confidence 80%
Acronis is a data protection and cybersecurity vendor with a concerning security track record. The company has shipped products with default configuration flaws—specifically default passwords and incorrect permissions—that enable remote code execution and privilege escalation, with at least one flaw actively exploited in the wild before a patch was released.
PROFILE
CategoryData Protection & CybersecurityWhat they doAcronis develops software for backup, disaster recovery, and endpoint cyber protection, serving managed service providers and IT teams.Founded2003HQSchaffhausen, SwitzerlandSize1,960
Websitehttps://www.acronis.com ↗
SECURITY POSTURE
Acronis has a mixed security posture, with a track record of shipping products with default configuration flaws that enable remote code execution and privilege escalation, some of which have been exploited in the wild.
Notable failures
- CVE-2023-45249: Default passwords enabling unauthenticated RCE
- CVE-2026-87886: Incorrect default permissions allowing privilege escalation
- CVE-2026-87886: Exploited in the wild before patching
Patterns: shipping products with insecure default configurations; vulnerabilities in third-party plugin integrations (cPanel, Plesk); high-severity flaws exploited in the wild prior to patching
FAILURE HISTORY · 2
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2024-07-29 | CVE-2023-45249 | high | Acronis Cyber Infrastructure shipped with default passwords enabling unauthenticated remote command execution. |
| 2026-09-16 | CVE-2026-87886 | high | Acronis Backup's cPanel and Plesk plugins shipped with incorrect default permissions allowing privilege escalation. |
DOSSIER SOURCES
- Acronis International GmbH: Acquired by EQT | Mandos · mandos.io
- Western Digital - Wikipedia · en.wikipedia.org
- Acronis Stock $49.06 | How to Buy, Valuation, Stock Price, IPO - Notice · notice.co
- Acronis Backup Plugin Vulnerability in cPanel and Plesk Exploited in ... · cyberpress.org
- Acronis, cPanel & WHM and Plesk: Acronis Plugin Vulnerability in cPanel ... · blog.rankiteo.com
- TRU Security by Acronis | Acronis · www.acronis.com
- TRU Security by Acronis | Acronis · www.acronis.com
- Acronis Plugin Vulnerability in cPanel and Plesk Exploited in the Wild · cybersecuritynews.com
- Acronis cPanel/WHM/Plesk Backup Plugin Under Active Exploitation: Linux ... · securityarsenal.com
Open questions: Has Acronis implemented a formal default-configuration security review process since 2024? · What is the current patch SLA for Acronis Cyber Infrastructure and Backup components?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-17 04:45:15.688855+00:00