- Top reward
- $10,000
- Top severity paid
- Critical
- Assets in scope
- 21
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 5 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$10,000 |
| High |
|
$3,500 |
| Medium |
|
$2,000 |
| Low |
|
$1,000 |
- Response
-
Within 5 days
We aim to respond within 5 business days
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorised conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
21 assets you may test, 2 excluded.
Desktop and binaries 7
- Acronis Agent Critical
- Acronis Cloud Manager Critical
- Acronis Cyber Protect Critical
- Acronis DeviceLock DLP Critical
- Acronis Snap Deploy Critical
- Acronis True Image (formerly Acronis Cyber Protect Home Office) Critical
- Other Acronis executables Critical
Wildcard domains 5
- *.5nine.com Critical
- *.acronis.com Critical
- *.acronis.work Critical
- *-api-*.acronis.com Critical
- *.devicelock.com Critical
iOS apps 3
- 1118448159 Critical
- 1192506963 Critical
- 978342143 Critical
Android apps 2
- com.acronis.abc Critical
- com.acronis.acronistrueimage Critical
Web 2
- account.acronis.com Critical
- beta-cloud.acronis.com Critical
Products and areas 2
- Acronis Cyber Infrastructure Critical
- Other Acronis Domains Medium
Out of scope (2)
- learn.acronis.com
- training.acronis.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Acronis (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Be an ethical hacker and respect other users' privacy
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service
-
Automated scanning tools must be limited to 5 requests per second to one target host summing up all tools and threads running in parallel
-
We kindly ask researchers to avoid testing on production systems whenever possible
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited
-
Only interact with accounts you own or with the explicit permission of the account holder
-
Always limit exploitation to minimal proof of concept required to demonstrate the vulnerability.
-
Manually validate each finding before submission, including findings produced with automated or AI-assisted tools.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-87886 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238. | High 7.8 | 17 Sep 2026 |
| CVE-2026-33271 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 42902. | Medium 6.7 | 2 Apr 2026 |
| CVE-2026-27774 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902. | Medium 6.7 | 2 Apr 2026 |
| CVE-2026-28728 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902. | Medium 6.7 | 2 Apr 2026 |
| CVE-2026-28725 | Sensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 5.5 | 6 Mar 2026 |
| CVE-2026-28727 | Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124, Acronis True Image (macOS) before build 42902. | High 7.8 | 6 Mar 2026 |
| CVE-2026-28726 | Sensitive information disclosure due to improper access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.3 | 6 Mar 2026 |
| CVE-2026-28721 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. | High 7.3 | 6 Mar 2026 |
| CVE-2026-28724 | Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.3 | 6 Mar 2026 |
| CVE-2026-28723 | Unauthorized report deletion due to insufficient access control. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.3 | 6 Mar 2026 |
| CVE-2026-28722 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. | High 7.3 | 6 Mar 2026 |
| CVE-2026-28720 | Unauthorized modification of settings due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.3 | 6 Mar 2026 |
| CVE-2026-28719 | Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.3 | 6 Mar 2026 |
| CVE-2026-28718 | Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | High 7.5 | 6 Mar 2026 |
| CVE-2026-28714 | Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.8 | 6 Mar 2026 |
| CVE-2026-28713 | Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186. | High 7.1 | 6 Mar 2026 |
| CVE-2026-28712 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. | Medium 6.3 | 6 Mar 2026 |
| CVE-2026-28717 | Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. | Medium 5.0 | 6 Mar 2026 |
| CVE-2026-28716 | Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.4 | 6 Mar 2026 |
| CVE-2026-28715 | Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 6.5 | 6 Mar 2026 |
| CVE-2026-28710 | Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Critical 9.8 | 6 Mar 2026 |
| CVE-2026-28709 | Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. | Medium 4.3 | 6 Mar 2026 |
| CVE-2026-28711 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186. | Medium 6.3 | 6 Mar 2026 |
| CVE-2025-11792 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124. | High 7.3 | 6 Mar 2026 |
| CVE-2025-30413 | Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186. | Medium 4.4 | 6 Mar 2026 |
| CVE-2025-11791 | Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186, Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124. | High 7.1 | 6 Mar 2026 |
| CVE-2025-11790 | Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124. | Medium 4.4 | 6 Mar 2026 |
| CVE-2025-30412 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800. | Critical 10.0 | 20 Feb 2026 |
| CVE-2025-30416 | Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800. | Critical 10.0 | 20 Feb 2026 |
| CVE-2025-30411 | Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800. | Critical 10.0 | 20 Feb 2026 |
| CVE-2024-55543 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. | High 7.8 | 2 Jan 2025 |
| CVE-2024-55541 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39169. | Medium 6.1 | 2 Jan 2025 |
| CVE-2024-55540 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. | High 7.8 | 2 Jan 2025 |
| CVE-2024-49392 | Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. | Medium 4.8 | 17 Oct 2024 |
| CVE-2024-49386 | Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. | Medium 5.7 | 17 Oct 2024 |
| CVE-2024-49389 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. | High 7.8 | 17 Oct 2024 |
| CVE-2024-49390 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. | High 7.3 | 17 Oct 2024 |
| CVE-2024-49391 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. | High 7.3 | 17 Oct 2024 |
| CVE-2024-49388 | Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. | Critical 9.1 | 15 Oct 2024 |
| CVE-2024-49387 | Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. | High 7.5 | 15 Oct 2024 |
| CVE-2024-49384 | Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. | Medium 4.3 | 15 Oct 2024 |
| CVE-2024-49382 | Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. | Medium 4.3 | 15 Oct 2024 |
| CVE-2024-49383 | Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. | Medium 4.3 | 15 Oct 2024 |
| CVE-2024-34017 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. | High 7.3 | 29 Aug 2024 |
| CVE-2024-34019 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. | High 7.3 | 29 Aug 2024 |
| CVE-2024-34018 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 4569. | Medium 5.5 | 29 Aug 2024 |
| CVE-2023-45249 | Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132. | Critical 9.8 | 24 Jul 2024 |
| CVE-2022-45449 | Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984. | Medium 6.5 | 16 Jul 2024 |
| CVE-2024-34012 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.24135.272. | Medium 4.4 | 14 Jun 2024 |
| CVE-2023-48679 | Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. | Medium 5.4 | 27 Feb 2024 |
| CVE-2023-48682 | Stored cross-site scripting (XSS) vulnerability in unit name. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. | Medium 5.4 | 27 Feb 2024 |
| CVE-2023-48681 | Self cross-site scripting (XSS) vulnerability in storage nodes search field. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. | Medium 6.1 | 27 Feb 2024 |
| CVE-2023-48680 | Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect 16 (macOS, Windows) before build 37391. | Medium 5.5 | 27 Feb 2024 |
| CVE-2023-48678 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 37391. | Medium 5.5 | 27 Feb 2024 |
| CVE-2023-48676 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36943. | High 7.1 | 14 Dec 2023 |
| CVE-2023-48677 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901, Acronis Cyber Protect Cloud Agent (Windows) before build 39378, Acronis Cyber Protect 16 (Windows) before build 39938, Acronis True Image OEM (Windows) before build 42575. | High 7.8 | 12 Dec 2023 |
| CVE-2023-45248 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36497, Acronis Cyber Protect 16 (Windows) before build 37391. | High 7.3 | 9 Oct 2023 |
| CVE-2023-45247 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36497, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169. | High 7.1 | 9 Oct 2023 |
| CVE-2023-45246 | Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36343, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169. | High 7.1 | 6 Oct 2023 |
| CVE-2023-45245 | Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36119. | Medium 5.5 | 6 Oct 2023 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Acronis looks forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe.
Rules for us
- We respect the time and effort of our researchers
- We aim to respond within 5 business days
- We aim to process reports within 10 business days
- We aim to determine bounty amount within 10 business days after triage
- We will do our best to keep you informed about our progress throughout the process
- Reports that meet the Report Quality Requirements below are prioritized. Reports that do not may take longer to review or be closed as Not Applicable
Rules for you
- Be an ethical hacker and respect other users' privacy
- Register accounts using your [username][email protected] addresses
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service
- If you do any automated scanning against Web resources and API-s make sure to place your @wearehackerone email into User-Agent header
- Automated scanning tools must be limited to 5 requests per second to one target host summing up all tools and threads running in parallel
- We kindly ask researchers to avoid testing on production systems whenever possible
Violation of these rules might result in ineligibility for a bounty or permanent ban
- Social engineering (e.g. phishing, vishing, smishing) is prohibited
- Only interact with accounts you own or with the explicit permission of the account holder
- If any sensitive information is accessed as a part of exploitation, it must not be stored, transferred or otherwise processed after the initial discovery. All copies of sensitive information must be returned to Acronis and may not be retained
- Always limit exploitation to minimal proof of concept required to demonstrate the vulnerability. Do not attempt to access Acronis or other users' accounts or data or post-exploitation of other vulnerabilities. Stop, report what you have found and request additional testing permission
- Use the following commands to demonstrate command execution vulnerabilities
| Non-root | Root |
|---|---|
id |
id |
cat /etc/hosts |
cat /proc/1/maps |
touch ~/[your H1 username] |
touch /root/[your H1 username] |
Report Quality Requirements
- Manually validate each finding before submission, including findings produced with automated or AI-assisted tools. Output produced solely by your proof of concept code or testing tool is not sufficient evidence
- Reports must contain clear steps to reproduce and sufficient evidence for initial validation without requiring the security team to execute researcher-provided scripts or tools. Provide relevant requests/responses or other evidence from the affected system
- Keep reports concise and focused on information needed to validate the vulnerability. Avoid lengthy vulnerability background, generic security explanations, hypothetical attack scenarios, AI-generated analysis, or repeated descriptions of the same issue
Reports that do not meet these requirements may be closed as Not Applicable without further investigation.
Recommendations
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact
- If you are submitting DLL files as part of your exploit, be sure to include the source code for them as well. Doing so helps us verify your proof of concept more accurately and quickly
Quickstart Guide
- Acronis Cyber Protect Cloud documentation is available at developer.acronis.com
- You can find quickstart guides and more information about Acronis products and services at care.acronis.com
- Note that some vulnerabilities may already be fixed in the beta versions (check assets description)
Rewards
- When duplicates occur, we only award the first report that we receive
- If a vulnerability is fixed in the beta version we will consider it as duplicate
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty
Public Disclosure
- Follow HackerOne's disclosure guidelines
- No vulnerability disclosure is allowed without express consent from Acronis. This rule applies to any vulnerability details as well as information obtained during exploitation even for resolved issues
- We may request up to 180 days of additional time after disclosure request or report resolution to remediate the issue. This time is usually required to distribute the fixed version among our customers
- Besides disclosing reports on HackerOne, we also publish details about discovered vulnerabilities and corresponding security updates in Acronis Advisory Database
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorised conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Contact Us
If you have a technical issue or a question related to Acronis bug bounty program, feel free to reach out to us at [email protected].
Thank you for helping keep Acronis and our users safe!