CVE-2026-87096

LowCVSS 3.3/10Last modified Oct 22, 2026

Description

Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.

Metrics

CVSS 3.0 3.3/10CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 21, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-871058.8Tanium addressed a SQL injection vulnerability in Threat Response.CVE-2026-871066.5Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaCVE-2026-871075.4Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token tCVE-2026-871084.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different projCVE-2026-871096.5An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing enCVE-2026-87119.8NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (forCVE-2026-871105.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly workCVE-2026-871117.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to StCVE-2026-871136.3Tanium addressed an improper access controls vulnerability in Threat Response.CVE-2026-871147.1A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container imagCVE-2026-871159.1The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path vaCVE-2026-871166.5Tanium addressed a server-side request forgery vulnerability in Threat Response.