CVE-2025-9578: Acronis Cyber Protect Privilege Escalation

CVE-2025-9578 Overview

CVE-2025-9578 is a local privilege escalation vulnerability in Acronis Cyber Protect Cloud Agent for Windows. The flaw stems from insecure folder permissions [CWE-732] and allows a low-privileged local user to elevate to SYSTEM. Acronis addressed the issue in build 40734 of the Windows agent. The vulnerability affects confidentiality, integrity, and availability at a high level once exploited. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
A local attacker with low privileges can gain SYSTEM-level code execution on Windows hosts running vulnerable versions of the Acronis Cyber Protect Cloud Agent.

Affected Products

Acronis Cyber Protect Cloud Agent for Windows before build 40734
Windows endpoints managed by the Acronis Cyber Protect Cloud service
Deployments where the agent installation directory retains default insecure permissions

Discovery Timeline

2025-08-28 - CVE-2025-9578 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9578

Vulnerability Analysis

The vulnerability is a local privilege escalation caused by weak permissions on folders used by the Acronis Cyber Protect Cloud Agent on Windows. Insecure Access Control List (ACL) entries on directories writable by standard users permit modification of files that are later executed or loaded by a service running as SYSTEM. An authenticated local attacker can plant or replace a binary, script, or dynamic-link library (DLL) in the affected directory. When the privileged service or scheduled task consumes that file, the attacker's code executes with elevated rights. Exploitation does not require user interaction and can be triggered locally without additional privileges beyond a standard user account.

Root Cause

The root cause is Incorrect Permission Assignment for a Critical Resource [CWE-732]. Installation of the agent created folders whose ACLs allowed non-administrative users to write, replace, or overwrite content. Because privileged agent processes trust files in these locations, the boundary between standard and administrative execution collapses. Build 40734 corrects the ACLs applied at install and upgrade time.

Attack Vector

Attackers require valid credentials on the target host but no administrative rights. The typical exploitation path involves identifying a writable file or folder within the agent installation tree, staging a malicious payload with the same name as a component loaded by the privileged service, and triggering the service to reload or restart. On execution, the payload inherits the SYSTEM security context. Refer to the Acronis Security Advisory SEC-9107 for vendor-supplied technical details.

// No verified public proof-of-concept is available for CVE-2025-9578.
// See the Acronis Security Advisory SEC-9107 for vendor technical details.

Detection Methods for CVE-2025-9578

Indicators of Compromise

Unexpected write, create, or rename events by non-administrative users inside the Acronis agent installation directory under C:\Program Files\ or C:\ProgramData\Acronis\.
New or modified .exe, .dll, or script files in agent folders that do not match vendor-signed hashes.
Child processes of the Acronis agent service (running as SYSTEM) that spawn command shells, powershell.exe, or other interactive binaries.

Detection Strategies

Audit ACLs on all Acronis agent directories and flag any entry granting write, modify, or full control to BUILTIN\Users, Authenticated Users, or Everyone.
Baseline the file inventory of the agent installation folder and alert on deviations from vendor-signed binaries.
Correlate Windows Security event ID 4663 (object access) with process-creation event ID 4688 to identify tampering followed by privileged execution.

Monitoring Recommendations

Enable file integrity monitoring on the Acronis installation and data directories.
Monitor for service restarts or scheduled task executions immediately following file modifications by non-privileged accounts.
Track token elevation and integrity level transitions originating from agent-owned processes.

How to Mitigate CVE-2025-9578

Immediate Actions Required

Upgrade the Acronis Cyber Protect Cloud Agent for Windows to build 40734 or later on every managed endpoint.
Inventory all Windows hosts running the agent and confirm the installed build through the management console.
Restrict interactive logon on servers hosting the agent to reduce the local attacker population.

Patch Information

Acronis released the fix in Cyber Protect Cloud Agent for Windows build 40734. Details are published in the Acronis Security Advisory SEC-9107. Apply the update through the standard Acronis Cyber Protect Cloud update workflow or manual reinstall.

Workarounds

Until patched, tighten NTFS permissions on the agent installation directory so that only SYSTEM and the local Administrators group have write access.
Remove inherited permissions that grant standard users modify rights to agent folders, then reapply explicit read-and-execute for Users.
Monitor the agent directory with an endpoint file integrity tool and alert on any write operation performed by a non-administrative principal.

bash

# Inspect current ACLs on the Acronis agent directory (run in an elevated PowerShell prompt)
icacls "C:\Program Files\Acronis"

# Remove write permissions for standard users as a temporary hardening step
icacls "C:\Program Files\Acronis" /remove:g "BUILTIN\Users"
icacls "C:\Program Files\Acronis" /grant:r "BUILTIN\Users:(OI)(CI)(RX)"