Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-45249

CVE-2023-45249CRITICAL

Acronis Cyber Infrastructure (ACI)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .5325   99.0   YES

AFFECTED
  Product                       Versions       Fixed
  Acronis Cyber Infrastructure  unspecified –  —
  Acronis Cyber Infrastructure  unspecified –  —
  Acronis Cyber Infrastructure  unspecified –  —
  Acronis Cyber Infrastructure  unspecified –  —
  Acronis Cyber Infrastructure  unspecified –  —

TIMELINE
  Oct 5   Reserved by Acronis
  Jul 24  Published (CNA: Acronis)
  Jul 29  Added to CISA KEV, remediation due 2024-08-19

CWE-1393 · CNA: Acronis · CVSS v3.0 · 3 references · KEV due August 19, 2024

Description

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 5, 2023	Reserved	Reserved by Acronis
July 24, 2024	Published	Published (CNA: Acronis)
July 29, 2024	KEV ADDED	Added to CISA KEV, remediation due 2024-08-19

Affected

Affected products and packages — 5 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Acronis	Acronis Cyber Infrastructure	—	unspecified	—
Acronis	Acronis Cyber Infrastructure	—	unspecified	—
Acronis	Acronis Cyber Infrastructure	—	unspecified	—
Acronis	Acronis Cyber Infrastructure	—	unspecified	—
Acronis	Acronis Cyber Infrastructure	—	unspecified	—

Weaknesses

CWE-1393

References (3)

https://security-advisory.acronis.com/advisories/SEC-6452 [vendor-advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-45249 [government-resource]
https://www.securityweek.com/acronis-product-vulnerability-exploited-in-the-wild/

Authoritative record: CVE-2023-45249 at cve.org

Vendors: acronis

Weaknesses: CWE-1393

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-45249 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.