CVE-2026-28711: Acronis Cyber Protect Privilege Escalation

CVE-2026-28711 Overview

CVE-2026-28711 is a local privilege escalation vulnerability affecting Acronis Cyber Protect 17 on Windows systems. The vulnerability stems from a DLL hijacking weakness (CWE-427) that allows a local attacker with low privileges to escalate their access by placing a malicious DLL in a location where the application searches for legitimate libraries. This type of vulnerability occurs when an application loads a DLL from an untrusted path, enabling attackers to execute arbitrary code with elevated privileges.

Critical Impact

Local attackers can leverage this DLL hijacking vulnerability to escalate privileges on Windows systems running vulnerable versions of Acronis Cyber Protect 17, potentially gaining high-level access to confidential data and system integrity.

Affected Products

• Acronis Cyber Protect 17 (Windows) before build 41186
• Microsoft Windows (as the underlying platform)

Discovery Timeline

• 2026-03-06 - CVE-2026-28711 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28711

Vulnerability Analysis

This DLL hijacking vulnerability exists in Acronis Cyber Protect 17 for Windows prior to build 41186. The vulnerability allows a local attacker to achieve privilege escalation by exploiting insecure DLL loading behavior. When the application attempts to load required dynamic-link libraries, it searches through multiple directories in a specific order. If the application does not properly validate or restrict the search path, an attacker can place a malicious DLL with the same name as an expected legitimate library in a directory that is searched before the intended location.

The attack requires local access to the system and the ability to write files to directories that are included in the DLL search path. Once the malicious DLL is loaded by the vulnerable application, the attacker's code executes with the privileges of the application, which may include SYSTEM-level access for security software like Acronis Cyber Protect.

Root Cause

The root cause of this vulnerability is improper control over the DLL search path (CWE-427: Uncontrolled Search Path Element). The Acronis Cyber Protect application fails to adequately validate the location from which DLLs are loaded, allowing attackers to inject malicious libraries. This typically occurs when applications rely on default Windows DLL search order without implementing proper safeguards such as absolute path specification or DLL search path restrictions.

Attack Vector

The attack vector is local, requiring the attacker to have existing access to the target system with low-level privileges. The exploitation process involves:

1. Identifying a DLL that Acronis Cyber Protect attempts to load during execution
2. Creating a malicious DLL with the same filename containing arbitrary code
3. Placing the malicious DLL in a directory that precedes the legitimate DLL location in the search path
4. Waiting for or triggering the application to load the malicious DLL
5. Achieving code execution with elevated privileges

The vulnerability mechanism involves Windows DLL search order exploitation. When Acronis Cyber Protect attempts to load a required library, it may search current working directory, system directories, and PATH environment variable locations. By placing a malicious DLL in a writable directory within this search path, an attacker can hijack the loading process. See the Acronis Security Advisory SEC-2330 for additional technical details.

Detection Methods for CVE-2026-28711

Indicators of Compromise

• Unexpected DLL files appearing in directories associated with Acronis Cyber Protect installation paths
• Unusual DLL loading events from non-standard locations in process monitoring logs
• Anomalous process behavior from Acronis services executing unexpected code
• File creation events in writable directories within the system PATH

Detection Strategies

• Monitor for DLL load events from Acronis Cyber Protect processes that reference DLLs outside of expected installation directories
• Implement application whitelisting to detect unauthorized DLL loading
• Use endpoint detection and response (EDR) solutions to identify suspicious DLL sideloading patterns
• Audit file system changes in directories commonly used for DLL hijacking attacks

Monitoring Recommendations

• Enable Windows Sysmon logging with configuration to capture DLL load events (Event ID 7)
• Configure SentinelOne to monitor for suspicious library loading behavior from backup and security software
• Implement file integrity monitoring on Acronis Cyber Protect installation directories
• Review Windows Security Event logs for privilege escalation indicators

How to Mitigate CVE-2026-28711

Immediate Actions Required

• Upgrade Acronis Cyber Protect 17 (Windows) to build 41186 or later immediately
• Audit systems for unauthorized DLL files in Acronis installation directories
• Review user permissions to restrict write access to directories in the DLL search path
• Monitor affected systems for signs of exploitation until patches are applied

Patch Information

Acronis has addressed this vulnerability in Acronis Cyber Protect 17 build 41186. Organizations should apply this update as soon as possible to remediate the DLL hijacking vulnerability. The security advisory with patch details is available at the Acronis Security Advisory SEC-2330.

Workarounds

• Restrict write permissions on directories in the PATH environment variable and common DLL search locations
• Implement application control policies to prevent execution of unsigned DLLs
• Use Windows Defender Application Control (WDAC) or similar solutions to enforce code integrity
• Temporarily limit local user access to systems running vulnerable Acronis versions until patching is complete

# Verify Acronis Cyber Protect build version
# Navigate to Acronis installation and check version info
# Ensure build number is 41186 or higher

# Restrict directory permissions to prevent malicious DLL placement
icacls "C:\Program Files\Acronis" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F"