CVE-2026-87103

HighCVSS 7.4/10Last modified Oct 29, 2026

Description

Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
AcronisAcronis Cyber Protect 17>= unspecified, < 42587

References

Timeline

Published
Oct 28, 2026
Last modified
Oct 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-871058.8Tanium addressed a SQL injection vulnerability in Threat Response.CVE-2026-871066.5Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaCVE-2026-871075.4Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token tCVE-2026-871084.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different projCVE-2026-871096.5An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing enCVE-2026-87119.8NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (forCVE-2026-871105.3An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly workCVE-2026-871117.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to StCVE-2026-871128.8The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 viCVE-2026-871136.3Tanium addressed an improper access controls vulnerability in Threat Response.CVE-2026-871147.1A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container imagCVE-2026-871159.1The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path va
CVE-2026-87103: High severity, CVSS 7.4 | Vulnix