Security readout for executives and security teams
Plain-English summary
Acronis Cyber Protect 15 had a stored XSS issue in activity details before build 28035. If abused, malicious content saved in the product could execute in another user's browser when viewed. The source bundle does not provide CVSS scoring or evidence of exploitation.
Executive priority
Prioritize remediation during the next security maintenance window, sooner for internet-exposed or broadly administered consoles. The issue can affect trusted administrative workflows, but sources do not show active exploitation or severity scoring.
Technical view
CVE-2021-44202 is CWE-79 stored cross-site scripting affecting Acronis Cyber Protect 15 on Windows and Linux before build 28035. The vulnerable area is activity details. Public sources in the bundle do not describe prerequisites, privileges, attack complexity, or payload behavior.
Likely exposure
Organizations using Acronis Cyber Protect 15 builds older than 28035 on Windows or Linux are potentially exposed. Risk is higher where multiple administrators or operators view shared activity details.
Exploitation context
The bundle marks this CVE as not in CISA KEV and provides no cited evidence of active exploitation. Treat exploitation status as unknown, not confirmed active.
Researcher notes
Evidence is sparse: affected product, platform, weakness type, location, and fixed build are known. Public bundle data lacks CVSS, exploitability details, prerequisites, and proof-of-concept references. Avoid assuming broader Acronis product impact.
Mitigation direction
- Upgrade Acronis Cyber Protect 15 to build 28035 or later.
- Review the Acronis advisory for vendor-specific remediation guidance.
- Restrict administrative console access to trusted users until upgraded.
- Monitor vendor channels for any revised severity or mitigation details.
Validation and detection
- Inventory Acronis Cyber Protect 15 deployments and record build numbers.
- Confirm Windows and Linux installations are build 28035 or newer.
- Review who can create or modify activity details.
- Check logs for unusual activity-detail changes or suspicious administrator sessions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-44202 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://security-advisory.acronis.com/advisories/SEC-3283CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.