Skip to content

CyberSIXT Search

Vendor

Acronis

No CISA KEV deadline is open. CISA last added a Acronis CVE on 16 Sep.

Tracked since 16 Sep · latest article Thu 17 Sep · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 1; of 2 all time
High exploit odds · current: 0; high · not in KEV
Articles · 7 days: 0; usual rate

Exploited, by due date

CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2026-87886Backup16 SepDeadline passed 19 SepRansomware: Unknown · 3 articles

CVE-2023-45249not in CyberSIXT coverageCyber Infrastructure (ACI)29 Jul 2024Deadline passed 19 Aug 2024Ransomware: Unknown · 0 articles

Products

2 products · 1 CVEs in coverage

Backup1 CVEs · 1 in KEVlatest 21 Sep Cyber Infrastructure0 CVEs · 1 in KEV

Coverage

3 articles · all timeFull timeline →

Three articles so far, 16 Sep to 17 Sep.

Wed 16 Sep · first reportAcronis Patches Exploited cPanel Backup Flaw Enabling Privilege GainSecurityWeek
Thu 17 SepCISA Flags Exploited Acronis Backup Flaw Allowing Privilege EscalationCISA
Thu 17 SepCISA Flags Actively Exploited Cisco, Acronis and Pixel FlawsSecurity Affairs

See the full timeline

17 SepCISA Flags Actively Exploited Cisco, Acronis and Pixel FlawsSecurity Affairs
17 SepCISA Flags Exploited Acronis Backup Flaw Allowing Privilege EscalationCISA · official notice
16 SepAcronis Patches Exploited cPanel Backup Flaw Enabling Privilege GainSecurityWeek

All CVEs in coverage

1

CVE-2026-87886Acronis Backup Incorrect Default Permissions VulnerabilityCVSS7.8HighExploited0.2%EPSS3articles

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.