CVE-2023-41748

CRITICAL

Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.

Affects 2 products across 2 vendors.

BCS7.38
CVSS 3.19.8
EPSS1.1%
Percentile61th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 51
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

A critical vulnerability in Acronis Cloud Manager (Windows) before build 6.2.23089.203 allows remote command execution due to improper input validation.

BSID: BS-2023-GLOBAL-344503-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-41748?
A critical vulnerability in Acronis Cloud Manager (Windows) before build 6.2.23089.203 allows remote command execution due to improper input validation.
What is the CVSS score for CVE-2023-41748?
CVE-2023-41748 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.1%.
Is CVE-2023-41748 actively exploited?
No confirmed active exploitation of CVE-2023-41748 as of 2026-05-30.
How do I remediate CVE-2023-41748?
Priority: IMMEDIATE. Advisory: https://security-advisory.acronis.com/advisories/SEC-5816 PSIRT: [email protected]
What systems are affected by CVE-2023-41748?
CVE-2023-41748 affects: Acronis, Microsoft.
Vulnerability Details
CVE IDCVE-2023-41748
BSIDBS-2023-GLOBAL-344503-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-08-31
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Improper Input Validation
SourceNVD
Official Description

Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending specially crafted input to the affected application, leading to arbitrary command execution with the privileges of the application.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Acronis Cloud Manager —
Microsoft Windows —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 1059 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash955f7e7d1f31af5e38eeb7c3765e9937ece946790865017513f9b6f3ba93e084829bec6d83f650deff62986147b4929a76c3d29c2866f13e14168ae91af487f0
Related CVEs affecting Acronis
CVE-2025-30416 10.0 Sensitive data disclosure and manipulation due to missing authorization. The ... CVE-2025-30411 10.0 Sensitive data disclosure and manipulation due to improper authentication. Th... CVE-2025-30412 10.0 Sensitive data disclosure and manipulation due to improper authentication. Th... CVE-2024-8767 9.9 Sensitive data disclosure and manipulation due to unnecessary privileges assi... CVE-2023-41746 9.8 Remote command execution due to improper input validation. The following prod...
View all Acronis CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →