Read the docs
TI-2020-08193 Aliases CVE-2020-10138GHSA-8h9x-6778-m2fg

Improper access control in Acronis Cyber Backup

Priority LOW 35CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis Cyber Backup and Cyber Protect contain a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.

Why it matters now

EPSS 0.00534 45th percentileScored 2026-11-07
Fix Fixed Cyber Backup (Acronis): 16363Cyber Protect (Acronis): 24600

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcronisCyber Backup12.5 to before 1636316363Patch availableCNA
AcronisCyber Protect15 to before 2460024600Patch availableCNA
  • Cyber Backup VendorAcronis Affected 12.5 to before 16363 Fixed in 16363 Patch available CNA
  • Cyber Protect VendorAcronis Affected 15 to before 24600 Fixed in 24600 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:acronis:cyber_backup:*:*:*:*:*:*:*:*before 12.5VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:*:*:*:*:*:*:*:*before 15VulnerableAcronis
  • cpe:2.3:a:acronis:cyber_backup:*:*:*:*:*:*:*:* Versions before 12.5 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:*:*:*:*:*:*:*:* Versions before 15 Vulnerable ·Acronis

Remediation

  • Fix · CNA Cyber Backup (Acronis) Fixed in 16363
  • Fix · CNA Cyber Protect (Acronis) Fixed in 24600

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10138
  2. 2026-10-03 Alias added: GHSA-8h9x-6778-m2fg

References

Advisory 1

  • TI-2022-03146 Improper privilege management in Acronis Cyber Protect 15 CVSS 3.1HIGH 8.8
  • TI-2022-13042 Improper authentication in Acronis Cyber Protect 15 CVSS 3.1HIGH 7.5
  • TI-2020-12722 An issue was discovered in Acronis Cyber Backup before 12.5 Build 16342. CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences