CVE-2026-87097

MediumCVSS 5.3/10Last modified Nov 6, 2026

Description

Sensitive information disclosure due to insufficiently protected credentials. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Oct 28, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-870983.1Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 17 (Linux, Window CVE-2026-870995.7Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis Cyber Protect 17 (Li CVE-2026-871003.6Protection mechanism failure due to missing binary hardening in Linux executables. The following products are affected: Acronis Cyber Protec CVE-2026-871016.2Sensitive information disclosure due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Win CVE-2026-871027.4Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Prote CVE-2026-871037.4Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Prote CVE-2026-871058.8Tanium addressed a SQL injection vulnerability in Threat Response.CVE-2026-871066.5Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exha CVE-2026-871075.4Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token t CVE-2026-871084.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different proj CVE-2026-871096.5An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing en CVE-2026-87119.8NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for