Skip to content
BackEsc
Sign in

Acronis · disclosed reports

Access Control

38 disclosed reports · $4,100 paid · 18 valid · 1 informative · 3 N/A · 16 not checked yet

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Open Acronis on HackerOne
reports
38
valid
18
paid a bounty
18

Every one of the 38 is a mark on the map. Named now: 1 to 26, most upvoted first.

  1. Ticket Trick at https://account.acronis.com#999765Acronis · 142 votesValid
  2. IP restriction bypass via X-Forwarded-For header#1224089Acronis · $250 · 126 votes
  3. Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/#1124974Acronis · 109 votesValid
  4. Subdomain takeover of main domain of https://www.cyberlynx.lu/#1256389Acronis · $100 · 70 votesValid
  5. Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)#945122Acronis · 38 votesValid
  6. Local Privilege Escalation and Code Execution when restoring files from Quarantine#980500Acronis · $250 · 30 votes
  7. Read-only administrator can change agent update settings#1538004Acronis · $200 · 29 votesValid
  8. Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - systeminfo.exe utility#959608Acronis · 26 votes
  9. Cross Origin Resource Sharing Misconfiguration#958459Acronis · 26 votesValid
  10. Local Privilege Escalation when updating Acronis True Image#1075449Acronis · $250 · 25 votes
  11. Local privilege escalation via insecure MSI file#1071832Acronis · $250 · 25 votesValid
  12. Local Privilege Escalation via Backup delete#1003007Acronis · $250 · 21 votes
  13. unauth mosquitto ( client emails, ips, license keys exposure )#1578574Acronis · $150 · 20 votesValid
  14. Any expired reset password link can still be used to reset the password#1615790Acronis · $100 · 19 votesValid
  15. Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow services#953719Acronis · 19 votesValid
  16. Broken Access Controls#833735Acronis · 19 votesValid
  17. Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation)#1083532Acronis · 17 votes
  18. Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm#1164854Acronis · $250 · 15 votesValid
  19. DLL Hijacking when sending feedback and crash report leading to Privilege Escalation#1008427Acronis · $250 · 15 votes
  20. Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine Service#959815Acronis · 15 votes
  21. Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow services#952166Acronis · 15 votesValid
  22. Acronis True Image Local Privilege Escalation via insecure folder permissions#908162Acronis · $300 · 15 votesValid
  23. TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative account#959017Acronis · $250 · 14 votes
  24. No Rate Limit On Forgot Password Page#1245529Acronis · 13 votesN/A
  25. DLL Hijacking when creating Rescue Media Builder leading to Privilege Escalation#1010552Acronis · $250 · 13 votes
  26. Local Privilege Escalation when deleting a file from Quarantine#983363Acronis · $250 · 11 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in