Is CVE-2023-45249 (Acronis Cyber Infrastructure (ACI) Insecure Default Password) being exploited in the wild?

Yes. CISA added CVE-2023-45249 to its Known Exploited Vulnerabilities catalogue on 29 July 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for this CVE

For CVE-2023-45249, the key operational question is not whether the flaw exists, but whether attackers are already using it against exposed Acronis Cyber Infrastructure installations. CISA’s inclusion in the KEV catalogue is a strong signal that exploitation has moved beyond theory and into active use, so the right response is exposure verification and urgent remediation, not routine backlog handling.

When a default password weakness is confirmed in a product that can execute commands remotely, the practical risk is immediate: any system reachable by an unauthenticated attacker may already be a foothold. The issue is not limited to an isolated account control problem, because default credentials can collapse the initial access barrier entirely.

How to confirm whether your environment is exposed

Start by identifying every deployed ACI instance, including test, lab, DR and legacy nodes that may not appear in the main asset inventory. Then confirm whether the affected product is present, whether any default credentials remain in use, and whether administrative or service access paths are reachable from untrusted networks. If you cannot prove that default passwords are removed, assume exposure until proven otherwise.

For prioritisation, treat internet-facing or broadly reachable deployments as the highest concern, followed by internal systems that accept remote management from shared admin networks. The relevant question is not just “is ACI installed?” but “could an unauthenticated actor reach a command-execution path because a default password still exists somewhere in the environment?”

What remediation should look like when exploitation is plausible

Immediate remediation should focus on removing the default password condition, applying the vendor’s fix or mitigation guidance, and reducing reachability while remediation is underway. If the product cannot be patched immediately, isolate it, restrict management access to trusted administrative paths, and remove any unnecessary exposure to the broader network or the internet.

You should also review whether the system handled sensitive data, stored credentials, or provided privileged infrastructure access. If so, assume the weakness may have exposed more than a single login surface and validate whether adjacent secrets, sessions, or administrative credentials need rotation as part of containment.

Risk and Threat Considerations

Default passwords are attractive to attackers because they remove the need for guessing, phishing, or credential cracking. In a remotely reachable infrastructure product, that can turn a single missed hardening step into direct command execution, rapid privilege use, and potential lateral movement into the wider environment.

Failure mechanism: The product accepts a known or default credential state, allowing an unauthenticated attacker to reach administrative functionality and execute commands remotely before defenders notice abnormal access.

Impact: A successful intruder can gain initial foothold, alter configuration, steal credentials or data, and use the compromised infrastructure as a pivot point into connected systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Default passwords are an account-control failure that requires prompt remediation.
Recommendation — Eliminate default credentials and verify every account has a unique, managed password.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Default passwords are authenticator material that must be changed and governed.
	IA-2 — Identification and Authentication (Organizational Users)	Remote command access should not be available without verified authentication.
	SC-7 — Boundary Protection	Exposure of a remotely reachable management surface drives the attack risk here.
Recommendation — Rotate and manage authenticators so no default credential remains usable. Require authenticated access before any administrative or command-capable function is exposed. Restrict management access to trusted network paths and block unnecessary exposure.
NIST CSF 2.0	PR.AA-05 — Identity Management, Authentication, and Access Control	The issue is a failure of access control through default credentials.
Recommendation — Remove default access paths and enforce unique authentication for all administrative entry points.

Practitioner Guidance

What to prioritise: Treat any exposed ACI deployment as an incident-response priority if you cannot immediately prove that default passwords are eliminated and remote management exposure is constrained. CISA KEV listing is a strong trigger to move this work ahead of normal maintenance queues.

What to verify: Confirm the exact ACI instances in scope, whether the default password state existed on any node, and whether logs show unexpected remote access, command execution, account creation, or configuration changes around the exposure window.

Decision rule: If the system was reachable by untrusted users or the default credential state cannot be ruled out, rotate relevant administrative credentials, review for compromise, and restore trust in the host before returning it to normal service.

Practitioner takeaway: For KEV-listed default-password flaws, the defensive posture should be containment first, proof of exposure second, and routine patch scheduling last.