CVE-2025-11792: Acronis Cyber Protect Cloud DLL Hijacking

CVE-2025-11792 Overview

CVE-2025-11792 is a local privilege escalation vulnerability affecting Acronis Cyber Protect Cloud Agent for Windows. The vulnerability stems from a DLL hijacking weakness (CWE-427: Uncontrolled Search Path Element) that allows an attacker with local access and low privileges to escalate their privileges on the affected system.

This vulnerability occurs when the application loads dynamic-link libraries (DLLs) from an insecure search path, allowing a malicious actor to place a crafted DLL in a location where the application will load it with elevated privileges.

Critical Impact

A local attacker with limited privileges can exploit this DLL hijacking vulnerability to achieve elevated privileges, potentially gaining complete control over the affected Windows system running Acronis Cyber Protect Cloud Agent.

Affected Products

• Acronis Cyber Protect Cloud Agent (Windows) before build 41124

Discovery Timeline

• 2026-03-06 - CVE CVE-2025-11792 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2025-11792

Vulnerability Analysis

This DLL hijacking vulnerability exists in Acronis Cyber Protect Cloud Agent for Windows installations prior to build 41124. The vulnerability allows a local attacker to achieve privilege escalation by exploiting the application's insecure DLL loading behavior.

DLL hijacking vulnerabilities occur when an application searches for required DLLs in directories that may be writable by lower-privileged users. When the application runs with elevated privileges (as backup agents typically do), loading a malicious DLL from a user-controlled location allows the attacker's code to execute with those elevated privileges.

The attack requires local access to the system and user interaction, but the potential impact is significant—successful exploitation could result in high confidentiality, integrity, and availability impacts on the affected system.

Root Cause

The root cause is CWE-427: Uncontrolled Search Path Element. The Acronis Cyber Protect Cloud Agent fails to properly validate or restrict the search path used when loading DLL files. This allows an attacker to place a malicious DLL in a directory that appears earlier in the DLL search order than the legitimate DLL location.

Attack Vector

The attack requires local access to the target system. An attacker must:

1. Identify a DLL that the Acronis Cyber Protect Cloud Agent attempts to load from an insecure location
2. Place a malicious DLL with the same name in a directory that the application searches before the legitimate DLL location (such as the application's working directory or a directory in the system PATH)
3. Wait for or trigger the application to load the DLL, at which point the malicious code executes with the application's privileges

The vulnerability requires user interaction (UI:R) to trigger, suggesting the exploit may be activated when a user performs specific actions within the agent or when certain application features are invoked.

For detailed technical information about this vulnerability, refer to the Acronis Security Advisory SEC-9439.

Detection Methods for CVE-2025-11792

Indicators of Compromise

• Unexpected DLL files appearing in directories associated with Acronis Cyber Protect Cloud Agent installation or working directories
• DLL files with suspicious timestamps or digital signatures in system PATH directories
• Process execution anomalies where Acronis processes load DLLs from non-standard locations
• Unexpected privilege escalation events associated with Acronis-related processes

Detection Strategies

• Monitor file system activity for DLL creation in directories where Acronis Cyber Protect Cloud Agent operates
• Implement application whitelisting to detect unauthorized DLLs being loaded by Acronis processes
• Use endpoint detection and response (EDR) solutions to monitor for DLL sideloading patterns
• Audit process creation events for suspicious parent-child process relationships involving Acronis components

Monitoring Recommendations

• Enable Windows Security Event logging for process creation (Event ID 4688) with command line auditing
• Configure Sysmon to capture DLL load events (Event ID 7) for Acronis-related processes
• Implement file integrity monitoring on Acronis installation directories
• Monitor for unexpected privilege escalation attempts through Windows Security Events

How to Mitigate CVE-2025-11792

Immediate Actions Required

• Update Acronis Cyber Protect Cloud Agent (Windows) to build 41124 or later immediately
• Audit systems running affected versions to identify any signs of exploitation
• Review file permissions on directories in the DLL search path to restrict write access
• Implement application control policies to prevent unauthorized DLL loading

Patch Information

Acronis has addressed this vulnerability in Acronis Cyber Protect Cloud Agent for Windows build 41124. Organizations should update to this version or later to remediate the vulnerability.

For official patch information and download links, refer to the Acronis Security Advisory SEC-9439.

Workarounds

• Restrict write permissions on directories in the system PATH and application working directories
• Implement application whitelisting solutions to prevent unauthorized DLL execution
• Use Windows Defender Application Control (WDAC) or AppLocker to enforce code integrity policies
• Limit local user privileges to reduce the attack surface for privilege escalation attempts

# Verify Acronis Cyber Protect Cloud Agent version
# Check if the installed build is 41124 or later
wmic product where "name like 'Acronis%'" get name,version

# Review directory permissions for Acronis installation
icacls "C:\Program Files\Acronis" /T