CVE-2026-28714 Information disclosure in Acronis Cyber Protect 17

Medium 4.8 Published 5 Mar 2026 Updated 9 Mar 2026

Attackers can intercept sensitive cryptographic material transmitted by Acronis Cyber Protect, potentially compromising security.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-28714?

CVE-2026-28714 is a medium-severity vulnerability in Acronis Cyber Protect, published on 5 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

Weakness: CWE-522

Which versions are affected by CVE-2026-28714?

It affects 1 product.

Products include Acronis Cyber Protect.

How do I fix CVE-2026-28714?

No fix has been published for CVE-2026-28714 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-28714 being exploited?

There is no known exploitation of CVE-2026-28714 in the wild and no public exploit code.

All Acronis Cyber Protect vulnerabilities

Sources

Also known as GHSA-3q66-2qch-5x6m.