Security readout for executives and security teams
Plain-English summary
CVE-2021-44203 is a stored cross-site scripting issue in Acronis Cyber Protect 15 protection plan details. If an organization runs affected builds, malicious content could be stored in the product and later executed in a user’s browser when viewed. The provided sources do not include CVSS scoring or active-exploitation evidence.
Executive priority
Prioritize routine remediation if Acronis Cyber Protect 15 is in use, especially on shared administration systems. There is no active-exploitation evidence in the supplied sources, but stored XSS can affect trusted user sessions and should not remain unpatched.
Technical view
The issue is classified as CWE-79 stored XSS. Acronis Cyber Protect 15 on Windows and Linux is affected before build 28035. The source bundle does not provide a CVSS vector, detailed prerequisites, exploit maturity, or a broader version matrix beyond the vendor build boundary.
Likely exposure
Exposure is limited to organizations running Acronis Cyber Protect 15 for Windows or Linux before build 28035. Risk is more relevant where users can create or edit protection plan details that other users later view.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of active exploitation or public weaponization. Stored XSS generally depends on malicious stored content being viewed by another user, but the exact required privileges and impact path are not documented here.
Researcher notes
Evidence is sparse: only the affected product, platform, vulnerability class, and fixed-build boundary are supplied. Avoid assuming exploitability details, required privileges, or session impact without reviewing SEC-3294 or vendor support material.
Mitigation direction
- Upgrade Acronis Cyber Protect 15 to build 28035 or later.
- Review Acronis advisory SEC-3294 for vendor remediation details.
- Restrict who can create or modify protection plan details until upgraded.
- Monitor Acronis guidance for any updated severity or workaround information.
Validation and detection
- Inventory Acronis Cyber Protect 15 deployments on Windows and Linux.
- Confirm each deployment build number is 28035 or later.
- Identify users who can manage protection plan details.
- Check whether affected instances are still reachable by untrusted users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-44203 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://security-advisory.acronis.com/advisories/SEC-3294CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.