How severe is CVE-2024-49382?

CVE-2024-49382 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-49382 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-49382?

CVE-2024-49382 primarily affects Acronis Cyber Protect. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-49382?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-49382 have an EU (EUVD) identifier?

Yes. CVE-2024-49382 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-43410.

When was CVE-2024-49382 published?

CVE-2024-49382 was published on 2024-10-15 and last updated on 2026-06-17.

CVE-2024-49382

CVE-2024-49382 is a medium-severity vulnerability in Acronis Cyber Protect with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1327.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 0% (11th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-43410
Weakness: CWE-1327
Affected product: Acronis Cyber Protect
Published: 2024-10-15
Last modified: 2026-06-17

Description

Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.

Frequently asked questions

What is CVE-2024-49382?: Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690.
How severe is CVE-2024-49382?: CVE-2024-49382 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-49382 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-49382?: CVE-2024-49382 primarily affects Acronis Cyber Protect. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-49382?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-49382 have an EU (EUVD) identifier?: Yes. CVE-2024-49382 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-43410.
When was CVE-2024-49382 published?: CVE-2024-49382 was published on 2024-10-15 and last updated on 2026-06-17.

References

https://security-advisory.acronis.com/advisories/SEC-7286

Affected products (3)

cpe:2.3:a:acronis:cyber_protect:*:*:*:*:*:*:*:*
cpe:2.3:a:acronis:cyber_protect:16:-:*:*:*:*:*:*
cpe:2.3:a:acronis:cyber_protect:16:update1:*:*:*:*:*:*

More vulnerabilities in Acronis Cyber Protect

CVE-2025-30416 — Critical (CVSS 10.0): Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis…
CVE-2025-30412 — Critical (CVSS 10.0): Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis…
CVE-2025-30411 — Critical (CVSS 10.0): Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis…
CVE-2026-28710 — Critical (CVSS 9.8): Sensitive information disclosure and manipulation due to improper authentication. The following products are affected:…
CVE-2024-49388 — Critical (CVSS 9.1): Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber…
CVE-2023-44206 — Critical (CVSS 9.1): Sensitive information disclosure and manipulation due to improper authorization. The following products are affected:…

All CVEs affecting Acronis Cyber Protect →

Other CWE-1327 vulnerabilities

CVE-2025-61934 — Critical (CVSS 10.0): A binding to an unrestricted IP address vulnerability was discovered in Productivity Suite software version v4.4.1.19.…
CVE-2023-1968 — Critical (CVSS 10.0): Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An…
CVE-2026-24015 — Critical (CVSS 9.8): A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before…
CVE-2026-0481 — Critical (CVSS 9.2): Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to…
CVE-2026-42503 — High (CVSS 8.8): gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If…
CVE-2025-55322 — High (CVSS 7.3): Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.

Browse all CWE-1327 vulnerabilities →