CVE-2025-30410

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-20 · updated 2026-06-17
Weakness: CWE-306

Description

Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 41800.

Affected products

Acronis Cyber Protect Cloud Agent: before 39870 — fixed in 39870
Acronis Cyber Protect 15: before 39938; before 41800 — fixed in 39938, 41800

How to fix

Upgrade to a fixed version: Acronis Cyber Protect Cloud Agent 39870; Acronis Cyber Protect 15 39938, 41800. Check the vendor advisory for mitigations.

References

https://security-advisory.acronis.com/advisories/SEC-8641

Get alerted when CVE-2025-30410 or the next vulnerability affects your stack