CVE-2026-28718
Acronis Cyber Protect ≤ 17.0.41186
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-28718 is a high-severity Logging of Excessive Data (CWE-779) vulnerability in Acronis Cyber Protect. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AU-2 (Event Logging) and AU-7 (Audit Record Reduction and Report Generation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-28718 is a denial-of-service vulnerability caused by insufficient input validation in the authentication logging component of Acronis Cyber Protect 17. This issue affects the product on both Linux and Windows platforms in versions prior to build 41186. Published on 2026-03-06, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-779 (Logging of Excessive Data).
The vulnerability can be exploited by unauthenticated attackers accessible over the network, with low attack complexity and no requirement for user interaction. Successful exploitation allows the attacker to trigger a denial of service by causing high resource consumption through malformed input to the authentication logging mechanism, severely impacting availability while leaving confidentiality and integrity unaffected.
The Acronis security advisory SEC-8377, available at https://security-advisory.acronis.com/advisories/SEC-8377, provides details on mitigation. Affected systems should be updated to Acronis Cyber Protect 17 build 41186 or later to address the input validation flaw.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9953
Vulnerability Data
Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Defining the exact event types to be logged prevents indiscriminate collection of excessive data.
Audit-record reduction and on-demand reporting directly reduce the impact of overly verbose logs during review.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Excessive logging hinders log processing and forensic analysis, largely undermining DE.AE-04's ability to estimate impact/scope via SIEMs or tools while removing most of that outcome's efficacy.
Excessive logging undermines event analysis by flooding logs with noise that hinders processing and forensic review, but does not blind or defeat the outcome the way insufficient logging would.
Excessive logging impairs processing of provided event data and log-analysis findings (one aspect of DE.AE-06) without fully defeating alert/ticket distribution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.15 directly requires logging to be configured so that only necessary events are recorded, preventing excessive data.
Documented operating procedures can include logging guidelines, indirectly reducing excessive logging.
Monitoring activities can detect excessive logging but do not prescribe how much data should be logged.