CVE-2025-48961: Acronis Cyber Protect Privilege Escalation

CVE-2025-48961 Overview

CVE-2025-48961 is a local privilege escalation vulnerability in Acronis Cyber Protect 16 for Windows. The flaw stems from insecure folder permissions [CWE-732] on directories used by the product. A low-privileged local user can abuse the weak access control to influence files that a higher-privileged process later reads or executes. Successful exploitation grants elevated privileges on the affected host. Acronis addressed the issue in build 39938 of Cyber Protect 16 for Windows.

Critical Impact
A local, authenticated user can escalate privileges on Windows hosts running vulnerable builds of Acronis Cyber Protect 16, gaining high impact to confidentiality, integrity, and availability.

Affected Products

Acronis Cyber Protect 16 for Windows (all builds before 39938)
Windows endpoints and servers running the vulnerable agent
Environments where standard users have interactive logon on protected hosts

Discovery Timeline

2025-06-04 - CVE-2025-48961 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48961

Vulnerability Analysis

The vulnerability is an Incorrect Permission Assignment for a Critical Resource weakness [CWE-732]. Acronis Cyber Protect 16 creates or maintains folders on Windows with access control lists (ACLs) that grant write access to non-administrative users. Because privileged Acronis services and scheduled tasks read from or write to those directories, a local user with standard rights can stage content that the privileged process consumes. The attack requires local access, low privileges, and user interaction, and it results in high impact to confidentiality, integrity, and availability on the target host.

Root Cause

The root cause is insecure directory ACLs applied during installation or runtime of Acronis Cyber Protect 16. Folders that should be restricted to administrators inherit or receive permissions allowing modification by non-privileged principals such as Users or Authenticated Users. Any binary, script, DLL, or configuration file loaded from these paths by a SYSTEM-level service becomes an attacker-controllable input.

Attack Vector

Exploitation is local. An authenticated user places a malicious file into the writable Acronis folder and waits for the privileged service, updater, or scheduled task to load it. Common variants include DLL planting for search-order or side-loading hijacks, replacement of executables that run as SYSTEM, and tampering with configuration files that alter execution paths. Because user interaction is required per the CVSS vector, exploitation often chains with an administrator-triggered action such as a product update or scheduled backup job. See the Acronis Security Advisory SEC-8000 for vendor technical details.

Detection Methods for CVE-2025-48961

Indicators of Compromise

Unexpected executable, DLL, or script files written into Acronis Cyber Protect 16 installation or working directories by non-administrative users
ACL modifications on Acronis folders, or files whose owner is a standard user while the parent directory belongs to a privileged Acronis service
Child processes spawned by Acronis services (SYSTEM context) that execute binaries from user-writable paths
New scheduled tasks or services referencing binaries inside Acronis directories that were not deployed by the vendor installer

Detection Strategies

Audit ACLs on all Acronis Cyber Protect 16 folders using icacls and flag any path granting write or modify rights to Users, Authenticated Users, or Everyone.
Enable Windows object access auditing (Event ID 4663) on Acronis directories to record file creation and modification by non-privileged accounts.
Correlate process creation events (Event ID 4688 or Sysmon Event ID 1) where a SYSTEM-owned Acronis process loads modules from paths writable by standard users.

Monitoring Recommendations

Baseline the expected file inventory of Acronis directories and alert on deviations, especially for .exe, .dll, .ps1, and configuration files.
Monitor Acronis service accounts for anomalous child process trees, such as cmd.exe, powershell.exe, or unsigned binaries launched by product services.
Track installations and upgrades of Acronis Cyber Protect 16 across the fleet to confirm every host is running build 39938 or later.

How to Mitigate CVE-2025-48961

Immediate Actions Required

Upgrade Acronis Cyber Protect 16 for Windows to build 39938 or later on every affected endpoint and server.
Inventory all hosts running the agent and prioritize systems where non-administrative users have interactive logon rights.
Review and correct ACLs on Acronis installation and working directories so that only administrators and the product service account have write access.
Rotate credentials and review recent privileged activity on any host showing suspicious file writes into Acronis folders.

Patch Information

Acronis fixed the vulnerability in Cyber Protect 16 for Windows build 39938. Refer to the Acronis Security Advisory SEC-8000 for build downloads, verification instructions, and vendor guidance. Apply the update through the standard Acronis management console or offline installer, then confirm the build number in the product About dialog.

Workarounds

Restrict interactive and remote logon on backup servers to administrators until the patched build is deployed.
Manually tighten ACLs on Acronis directories to remove write and modify permissions for non-administrative principals as a temporary control.
Enable application allowlisting (such as Windows Defender Application Control or AppLocker) to block execution of unsigned binaries from Acronis paths.

bash

# Audit Acronis folder permissions on Windows (run in elevated PowerShell)
icacls "C:\Program Files\Acronis" /T /C | Select-String -Pattern "Users|Authenticated Users|Everyone"

# Remove write access for standard users on the Acronis directory
icacls "C:\Program Files\Acronis" /remove:g "Users" /T
icacls "C:\Program Files\Acronis" /remove:g "Authenticated Users" /T