CVE-2026-28710 is a critical (CVSS 9.8) improper authentication flaw in Acronis Cyber Protect 17 on Linux and Windows. It allows sensitive information disclosure and manipulation. Builds before 41186 are affected, so update to build 41186 or later and read the vendor advisory SEC-9137.
What's affected
The record says Acronis Cyber Protect 17 on Linux and Windows is affected before build 41186. Build 41186 is the first fixed build named in the record.
The record lists few further details. The vendor's advisory page requires JavaScript, so I could not read it in full. Read advisory SEC-9137 directly for the complete scope.
How to check if you're exposed
In the Cyber Protect console, open the agent or management server information and read the build number. Compare it with 41186. Check both your management server and any agents installed on Linux or Windows machines.
For anything you cannot inspect yourself, follow the steps in the Acronis advisory.
What to do now
- Read Acronis advisory SEC-9137 for the exact components and update path.
- Update Cyber Protect 17 to build 41186 or later on every Linux and Windows system that runs it.
- Restrict network access to the management interface to trusted networks.
- Review recent console and agent activity for changes you did not make.
Why it matters
The weakness is listed as CWE-1390, weak authentication. Backup and protection software holds privileged access to many machines and stores sensitive data, so an authentication flaw in it is worth quick attention.
The record does not mark the CVE as exploited in the wild, and it gives no technical details beyond the improper authentication label. Do not assume more than that. Follow the vendor's guidance.
Quick check
Which platforms are covered?
The record names Cyber Protect 17 on Linux and Windows. Check the vendor advisory for any other product lines before you decide you are out of scope.
Sources
Last reviewed: 19 October 2026.
