Last month’s bulletin covered the 26.09 build numbers and the fixes that shipped with them. This one covers what 26.09 actually changes in day-to-day use — the capabilities, and the operational conditions attached to them.

One console instead of several

The largest change in 26.09 is the Acronis Cyber Console: a single interface for managing Acronis services, replacing the habit of switching between legacy consoles.

From one place you can manage customers and tenants, discover and manage devices, open Remote Desktop sessions, run scripts, restart devices, apply protection plans, run backup jobs, patch devices, manage policies in bulk, manage roles and permissions, configure API clients and security settings, manage agent updates and credentials, and search across customers, users, devices, tickets and console pages. Cyber Intelligence, Cyber Studio, Service Desk and the Partner Portal are all reachable from the same console, and Acronis AI assistance sits inside it.

If your team currently keeps three tabs open to run a customer environment, this is the release that collapses them.

Cyber Studio: AI diagnosis and remediation

Cyber Studio can take an eligible alert, diagnose the issue, execute safe remote commands, attempt remediation, escalate to a technician when it cannot resolve the problem, and keep an execution and audit history of what it did.

The audit history is the part worth noting. Automated remediation without a record of what was run is a support problem waiting to happen; with one, it is a tier-1 workload you can hand over.

Cyber Intelligence — Early Access

A new area within Cyber Console that consolidates monitoring, dashboards, reporting and operational analytics. It is Early Access, so treat it as something to evaluate rather than to build a customer report pack on this quarter.

BitLocker management through Acronis RMM

This is the most useful item in the release for anyone running managed endpoints. Acronis RMM can now manage and enforce BitLocker drive encryption on Windows workloads.

You define the encryption method, which drives to encrypt, the encryption policy, TPM-based silent encryption, and where recovery keys are stored. Recovery keys are escrowed into the Acronis Credential Store and retrieved from the device details page, with access protected by 2FA and audit logging.

In practice that replaces configuring BitLocker machine by machine with a single path: RMM → Policy → BitLocker → automatic deployment → centralised recovery key. For managed endpoint customers who have been asking for encryption attestation, this is the answer.

NAS backups: more reliable, and faster

Two separate changes, both aimed at the same long-standing pain.

Reliability. Append-only backups to NAS and network folders now use a custom scheme combining full and incremental backups, and cleanup removes complete backup chains rather than individual components. The intent is to cut the risk of archive corruption caused by NAS hardware or storage problems.

Speed. Incremental backups of NAS shares have been optimised. The gain is largest where a share holds a very large number of files but only a small proportion of them change between runs — which describes most file servers.

Encryption password rotation for agentless VM backups — read the condition

Partners can now change the archive encryption password for backups containing agentless virtual machines. That covers key rotation, security-policy compliance, periodic password changes and customer security audits.

There is one operational condition that will catch people out: the password can only be changed again after every protected machine has completed at least two successful backups using the new password. If you plan a rotation across a large estate, build that into the schedule rather than discovering it halfway through.

Better EDR incident visibility

EDR now records the automatic response actions taken by Acronis antimalware protection. Previously, if an incident was automatically mitigated and closed, administrators could not always see what had happened. You now get visibility into file quarantine, process termination, process deletion, investigation state changes and threat status changes.

That matters most when a customer asks what was done about an alert that closed itself.

Cyber Frame Cloud

• Windows Server Datacenter images. The catalogue now includes Windows Server 2019, 2022 and 2025 Datacenter, alongside the Standard editions.
• Network throughput. The default egress QoS limit per virtual network adapter rises from 200 MB/s to 1 GB/s, with a short-term burst of a further 50%. Relevant for workloads doing significant VM-to-VM traffic.

If you have not moved yet

The current Cyber Protection agent is 26.9.43144, available for Windows, Linux and macOS.

The macOS deadline from last month still stands and is already in effect: from 26.09, Acronis no longer supports macOS 10.13 through macOS 12. The minimum supported version is macOS 13. Existing agents on older versions may keep working, but Acronis recommends upgrading the operating system. If you protect Macs on Monterey or older, that remains an upgrade project rather than a checkbox.

Want a second pair of eyes on the rollout?

Arrosoft manages Acronis environments for partners and their customers across APAC and North America. If you would like us to review which agent builds your estate is running, plan a BitLocker policy rollout, or sequence an encryption password rotation, get in touch.