CVE-2023-41746

CRITICAL

Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.

Affects 2 products across 2 vendors.

BCS7.38
CVSS 3.19.8
EPSS1.1%
Percentile62th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 51
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability in Acronis Cloud Manager (Windows) before build 6.2.23089.203 allows remote command execution due to improper input validation.

BSID: BS-2023-GLOBAL-056234-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-41746?
A critical vulnerability in Acronis Cloud Manager (Windows) before build 6.2.23089.203 allows remote command execution due to improper input validation.
What is the CVSS score for CVE-2023-41746?
CVE-2023-41746 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.1%.
Is CVE-2023-41746 actively exploited?
No confirmed active exploitation of CVE-2023-41746 as of 2026-05-30.
How do I remediate CVE-2023-41746?
Priority: IMMEDIATE. Advisory: https://security-advisory.acronis.com/advisories/SEC-5810 PSIRT: [email protected]
What systems are affected by CVE-2023-41746?
CVE-2023-41746 affects: Acronis, Microsoft.
Vulnerability Details
CVE IDCVE-2023-41746
BSIDBS-2023-GLOBAL-056234-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-08-31
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Improper Input Validation
SourceNVD
Official Description

Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending specially crafted input to the affected application, leading to arbitrary command execution with the privileges of the application.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Acronis Cloud Manager —
Microsoft Windows —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: August 2026 | Threat Age: 1082 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash0c85a279ee13b5a7972c60670901ecb5ea6304b9e12f44d3aa3d735c32d915b973924deec4e09c65350118812e2decaacb9b077c08bf8173bb68d724038126a4
Related CVEs affecting Acronis
CVE-2025-30416 10.0 Sensitive data disclosure and manipulation due to missing authorization. The ... CVE-2025-30411 10.0 Sensitive data disclosure and manipulation due to improper authentication. Th... CVE-2025-30412 10.0 Sensitive data disclosure and manipulation due to improper authentication. Th... CVE-2024-8767 9.9 Sensitive data disclosure and manipulation due to unnecessary privileges assi... CVE-2023-41748 9.8 Remote command execution due to improper input validation. The following prod...
View all Acronis CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →