Acronis Cyber Infrastructure (ACI) Remote Code Execution Vulnerability due to Default Passwords (CVE-2023-45249) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAcronis Cyber Infrastructure (ACI) versions prior to 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132
Unauthenticated remote attackers can exploit default credentials to execute arbitrary commands and gain full control over the infrastructure
Immediately upgrade to the patched versions (5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, 5.4.4-132 or later)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
According to the official Acronis advisory, systems must be updated to the latest release. Use the following commands to initiate the upgrade process on the ACI cluster.
# Start the Acronis Cyber Infrastructure cluster upgrade
vinfra cluster upgrade start
# Monitor the upgrade progress
vinfra cluster upgrade show2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the management ports using firewalls (iptables/firewalld) to ensure only trusted administrator IPs can connect.
# Restrict management port access using firewalld
# Remove public access and allow only a trusted IP (e.g., 192.168.10.50)
firewall-cmd --permanent --zone=public --remove-port=8443/tcp
firewall-cmd --permanent --zone=internal --add-source=192.168.10.50/32
firewall-cmd --permanent --zone=internal --add-port=8443/tcp
firewall-cmd --reload3. Log Audit & IoC Verification Commands
Verify the currently installed version of Acronis Cyber Infrastructure and inspect logs for unauthorized login attempts or remote command execution.
# Check the installed ACI package version
rpm -qa | grep -i 'vstorage-ui-backend'
# Audit security logs for anomalous authentication and session creation
grep -i 'session' /var/log/vstorage-ui-backend/messages.log | grep -E 'admin|root'Detect Container Escape & Privilege Escalation Across Your Kubernetes Fleet
Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-45249) exists in Acronis Cyber Infrastructure (ACI) due to the use of default passwords (CWE-1393). Certain administrative services or internal communication ports enabled during deployment utilize weak, pre-configured credentials, allowing unauthorized remote access without proper authentication.
2. Exploitation Mechanics & Attack Scenario
An attacker scans the network to identify exposed Acronis Cyber Infrastructure nodes. By leveraging the unchanged default credentials, the attacker authenticates against the management interface or API endpoints. Once authenticated, the attacker gains administrative privileges and can abuse built-in command execution functionalities to run arbitrary OS commands remotely (RCE). This vulnerability has been actively exploited in the wild and is listed in the CISA KEV catalog.
3. Infrastructure & Business Impact
Acronis Cyber Infrastructure manages critical enterprise virtualization, storage, and backup resources. Exploitation of this vulnerability allows attackers to access backup data, deploy ransomware, or disrupt business continuity. Furthermore, compromising the hypervisor or storage nodes can lead to lateral movement across the entire virtual machine (VM) and container environment.
Official Vendor Advisories & References
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
Frequently Asked SecOps Questions (CVE-2023-45249)
FAQQ1. How critical is CVE-2023-45249 and is it actively exploited in the wild?
CVE-2023-45249 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 53.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-45249?
Primary impacted vendors include acronis across cyber infrastructure. Scope summary: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132
Q3. What temporary mitigations or workarounds exist for CVE-2023-45249 before patching?
[Mitigation] Immediately upgrade to the patched versions (5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, 5.4.4-132 or later) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-45249
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (acronis)
View Category →Acronis Backup Plugins Local Privilege Escalation Advisory (CVE-2026-87886) - cPanel, Plesk, DirectAdmin
[Affected Scope] Acronis Backup plugins for Linux-based hosting panels (cPanel, Plesk, DirectAdmin) prior to specific builds.
Kestra Orchestration Platform Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2026-49869)
[Affected Scope] Kestra open-source versions prior to 1.0.45 and 1.3.21
MLflow Webhook Test Endpoint Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-64849)
[Affected Scope] MLflow versions from 3.3.0 prior to 3.15.0
VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) - Audit Bypass and Admin Activity Concealment
[Affected Scope] VMware ESX hypervisor environments.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.