Acronis · Cyber Infrastructure (ACI)

CVE-2023-45249

Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 53%

What it is

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.

CISA: Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: August 19, 2024

security-advisory.acronis.com/advisories/SEC-6452

Added to the CISA list: July 29, 2024
Published: July 24, 2024
Severity: Critical 9.8 CVSS 3.0
Chance of attacks in the next 30 days (EPSS): 53% in the top 1.0% of all known vulnerabilities
Weakness: CWE-1393
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Acronis

Added	Vulnerability	Product	Severity	Attack chance
Sep 16, 2026	Incorrect Default PermissionsCVE-2026-87886	Backup	High 7.8	0.2%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.