CVE-2025-48963: Acronis Cyber Protect Cloud Privilege Escalation

CVE-2025-48963 Overview

CVE-2025-48963 is a local privilege escalation vulnerability in Acronis Cyber Protect Cloud Agent caused by improper soft link handling. The flaw affects Acronis Cyber Protect Cloud Agent on Linux, macOS, and Windows platforms prior to build 40296. An authenticated local attacker can abuse symbolic link resolution to gain elevated privileges on the host. The weakness is classified under CWE-610: Externally Controlled Reference to a Resource in Another Sphere. Acronis has published details in Acronis Security Advisory SEC-8568.

Critical Impact
A local attacker with limited privileges can escalate to higher-privilege contexts, compromising confidentiality, integrity, and availability on affected agents.

Affected Products

Acronis Cyber Protect Cloud Agent for Linux before build 40296
Acronis Cyber Protect Cloud Agent for macOS before build 40296
Acronis Cyber Protect Cloud Agent for Windows before build 40296

Discovery Timeline

2025-08-28 - CVE-2025-48963 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48963

Vulnerability Analysis

The Acronis Cyber Protect Cloud Agent performs privileged file operations without validating whether target paths resolve through symbolic links. A local user who controls a directory or file path referenced by the agent can substitute a soft link pointing to a sensitive system resource. When the agent completes the operation under its elevated context, it acts on the attacker-chosen target instead of the intended path.

Successful exploitation gives the attacker write, overwrite, or delete access to resources normally protected by the operating system. This enables arbitrary file manipulation as a privileged user and typically leads to full local privilege escalation. Because the agent runs on Linux, macOS, and Windows, the exploitation pattern varies by platform but the root cause is consistent.

Root Cause

The root cause is improper soft link handling, tracked as [CWE-610]. The agent resolves file paths without verifying that intermediate or final path components are symbolic links pointing outside the expected trust boundary. This missing check allows a low-privileged local user to redirect privileged file operations.

Attack Vector

Exploitation requires local access, low privileges, and user interaction, according to the published CVSS vector. The attacker prepares a symbolic link in a directory the Acronis agent will access. When the agent processes the crafted path during a backup, restore, log write, or temporary file operation, it follows the link and writes to a location the attacker could not otherwise modify.

No verified public exploit code is available. Refer to the Acronis Security Advisory SEC-8568 for vendor-published technical details.

Detection Methods for CVE-2025-48963

Indicators of Compromise

Unexpected symbolic links inside directories used by the Acronis Cyber Protect Cloud Agent, such as temporary, log, or working directories.
Files owned by privileged accounts appearing with content or permissions consistent with tampering by non-privileged users.
Acronis agent log entries showing file operations on paths that resolve outside expected agent working directories.

Detection Strategies

Audit file system events for symlink, link, and rename operations performed inside Acronis agent working directories by non-agent user accounts.
Correlate process telemetry from the Acronis agent with file writes to sensitive system locations such as /etc, /usr/bin, or C:\Windows\System32.
Compare installed Acronis Cyber Protect Cloud Agent build numbers across the fleet against the fixed build 40296.

Monitoring Recommendations

Enable file integrity monitoring on the Acronis agent installation directories and any paths written to by the agent service.
Alert on creation of symbolic links by low-privileged users in directories accessed by services running as root, SYSTEM, or admin.
Track process ancestry for the Acronis agent process to identify anomalous child processes or file operations following link resolution.

How to Mitigate CVE-2025-48963

Immediate Actions Required

Upgrade Acronis Cyber Protect Cloud Agent to build 40296 or later on all Linux, macOS, and Windows hosts.
Inventory managed endpoints to confirm no agent instance remains on a vulnerable build.
Restrict local interactive and shell access on servers running the Acronis agent to trusted administrators only.

Patch Information

Acronis fixed the issue in Cyber Protect Cloud Agent build 40296. Apply the vendor-provided update as documented in Acronis Security Advisory SEC-8568. No supported workaround replaces installing the patched build.

Workarounds

Limit local user accounts on protected systems and remove unnecessary shell access to reduce exposure until patching completes.
Apply stricter permissions on directories used by the Acronis agent so unprivileged users cannot create symbolic links within them.
Monitor for symbolic link creation events in agent working directories and treat anomalies as high-priority alerts.

bash

# Example: identify Acronis agent build on Linux hosts
rpm -qa | grep -i acronis
dpkg -l | grep -i acronis
# Compare reported build against fixed build 40296