How do you patch or mitigate CVE-2023-45249 (Acronis Cyber Infrastructure (ACI) Insecure Default Password)?

By NHI Mgmt Group Editorial Team Updated October 17, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2023-45249 is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. In practice, find every instance of Acronis Cyber Infrastructure (ACI) in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service.

What the fix actually means for an ACI default-password vulnerability

The practical goal is to remove the conditions that let an attacker log in with a predictable or retained default secret. For CVE-2023-45249, that means confirming every Acronis Cyber Infrastructure instance, applying the vendor’s documented remediation, and verifying that the exposed login path is no longer reachable with the default password state. If the vendor fix cannot be applied, the product should not remain internet-facing.

Default-password flaws are rarely just a password problem. They usually mean an attacker can move straight from discovery to authenticated access, so the remediation has to be treated as an access-control event, not a routine configuration cleanup. That is why the first job is estate-wide identification of ACI rather than waiting for a report of abuse.

How to confirm exposure and close the path

Start by finding every deployed ACI node, management plane, backup or admin interface, and any externally reachable endpoint associated with the product. Then compare each instance against the vendor’s security update or mitigation instructions and confirm the system is either remediated or isolated from untrusted networks. For vulnerability tracking and authoritative record details, use the NIST National Vulnerability Database alongside the CISA Known Exploited Vulnerabilities Catalog.

If you have to defer the update, the mitigation is to shrink exposure immediately: remove public reachability, restrict management access to trusted administrative networks, and disable the service if you cannot bring it into a known-safe state. The key judgement is whether the product can still accept any unauthorised login path while you wait for maintenance. If yes, the exposure remains live.

Use the vendor advisory as the version and remediation source of truth, because the exact fix path belongs to the product owner and may include product-specific steps that should not be guessed from a CVE summary alone. The CVE record exists to identify the weakness; the vendor guidance tells you how to remove it safely in your environment.

What to do if patching is delayed or compromise is suspected

When patching is delayed, treat the exposed system as potentially already targeted. Review authentication logs, administrative actions, and any unusual configuration changes around the management surface. If the password weakness could have been abused, assume that any credentials, sessions, or administrative tokens used on that system may need to be reset or reissued, because a successful login can turn a default-password issue into broader control of the platform.

Look for signs that the appliance was used to pivot deeper into the environment, especially if the ACI management plane had network access to backup repositories, hypervisors, or storage. Where the product hosted secrets, automation accounts, or privileged integrations, check whether those downstream identities were touched. A default password is often the first step in a larger compromise, not the final one.

Risk and Threat Considerations

Default-password exposure creates an unusually low-effort intrusion path because attackers do not need to defeat authentication, they only need to discover the service and try a known or unchanged secret. If the product is exposed to the internet, the window between discovery and abuse can be very short.

Failure mechanism: An exposed ACI management interface allows unauthorised authentication through a default or otherwise predictable password state, which can give an attacker administrative control and a foothold for further internal access.

Impact: The likely impact is administrative takeover, configuration tampering, data exposure, service disruption, and possible lateral movement into adjacent systems that trust the infrastructure platform.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset vulnerabilities are identified and documented	CVE remediation depends on finding every exposed ACI instance first.
Recommendation — Inventory ACI assets and document the vulnerable exposure path before accepting remediation status.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	A default-password flaw is an authenticator lifecycle failure that must be removed or replaced.
Recommendation — Replace or disable the default authenticator and verify no usable default secret remains.
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Mitigation requires hardening exposed ACI instances and removing unsafe default access.
Recommendation — Harden ACI deployments and eliminate insecure default access paths.
OWASP Non-Human Identity Top 10	NHI-07 — Long-Lived Secrets	Default passwords behave like persistent secrets that should not remain usable in production.
Recommendation — Rotate or remove persistent secrets and ensure no default credential remains usable.

Practitioner Guidance

What to prioritise: Treat exposure reduction as part of the fix. If you cannot patch immediately, remove the management surface from the internet first, then verify the host is no longer accepting the vulnerable login path.

What to verify: Confirm the remediation on the live system, not just in change tickets. You want evidence that the vendor instruction was applied and that no remaining ACI endpoint can be authenticated with the default-password condition.

Decision rule: If the product still has an externally reachable management interface and you cannot prove the fix is effective, isolate or retire it before restoring normal access. The safer choice is to lose convenience temporarily than to leave a known login weakness available.

Practitioner takeaway: For default-password CVEs, the real control is not patching alone, it is proving that no reachable path remains where an attacker can turn product access into authenticated control.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org