CVE-2026-28712 Overview
CVE-2026-28712 is a local privilege escalation vulnerability in Acronis Cyber Protect 17 for Windows. The flaw stems from DLL hijacking [CWE-427], also known as uncontrolled search path element. An authenticated local attacker can place a malicious dynamic-link library (DLL) in a location searched by the vulnerable Acronis process. When the application loads the planted DLL, the attacker's code executes in the security context of the Acronis service. Acronis addressed the issue in build 41186.
Critical Impact
A low-privileged local user can execute arbitrary code with elevated privileges by planting a malicious DLL, leading to full compromise of confidentiality and integrity on the affected host.
Affected Products
- Acronis Cyber Protect 17 (Windows) before build 41186
- Microsoft Windows host platforms running the affected Acronis agent
- Endpoints with vulnerable Acronis Cyber Protect installations
Discovery Timeline
- 2026-03-06 - CVE-2026-28712 published to NVD
- 2026-03-11 - Last updated in NVD database
Technical Details for CVE-2026-28712
Vulnerability Analysis
The vulnerability resides in how Acronis Cyber Protect resolves and loads DLL dependencies at runtime. The product searches directories in an order that includes locations writable by lower-privileged users. An attacker who can write to such a directory can stage a malicious DLL matching the name of a library the application loads. When the Acronis service or a privileged process starts the dependent module, Windows loads the attacker-controlled DLL into the privileged process. The result is local privilege escalation with high impact to confidentiality and integrity, while availability is not directly affected.
Exploitation requires local access and valid low-privileged credentials. Attack complexity is elevated because the attacker must influence the search path or stage the DLL where the privileged process will locate it before the legitimate library.
Root Cause
The underlying weakness is an uncontrolled search path element [CWE-427]. Acronis Cyber Protect does not enforce fully qualified paths or signature validation for all loaded modules. This allows an attacker-controlled directory to be consulted ahead of the trusted system location.
Attack Vector
The attack vector is local. A standard user account on the Windows host plants a malicious DLL in a directory referenced by the vulnerable process. When the Acronis service loads the dependency, the injected code runs with the elevated privileges of that service. No user interaction is required after the DLL is staged. Refer to the Acronis Security Advisory SEC-2332 for vendor-supplied technical details.
Detection Methods for CVE-2026-28712
Indicators of Compromise
- Unsigned or unexpected DLL files appearing in directories adjacent to Acronis Cyber Protect binaries or in user-writable paths within the search order.
- Acronis service processes loading modules from non-standard directories outside of C:\Program Files\Acronis\.
- New child processes spawned by Acronis services that do not match known administrative workflows.
Detection Strategies
- Hunt for LoadLibrary and LoadLibraryEx events where Acronis processes load DLLs from unexpected paths.
- Compare loaded module hashes against known-good Acronis distribution baselines for build 41186 and later.
- Audit file creation events in directories within the Acronis search path, focusing on .dll writes by non-administrative users.
Monitoring Recommendations
- Enable Sysmon Event ID 7 (Image Loaded) for Acronis service binaries and forward to a centralized log platform.
- Monitor for privilege escalation patterns following DLL writes by standard user accounts.
- Alert on integrity changes to the Acronis installation directory and its subfolders.
How to Mitigate CVE-2026-28712
Immediate Actions Required
- Upgrade Acronis Cyber Protect 17 on Windows to build 41186 or later as directed in advisory SEC-2332.
- Inventory all Windows endpoints running Acronis Cyber Protect and prioritize patching for servers and high-value workstations.
- Restrict local logon rights and remove unnecessary local administrator privileges to limit who can stage malicious DLLs.
Patch Information
Acronis released a fixed version in build 41186 of Acronis Cyber Protect 17 for Windows. Apply the update through the Acronis management console or the standard product update channel. The vendor advisory is available at Acronis Security Advisory SEC-2332.
Workarounds
- Apply NTFS access control lists that prevent non-privileged users from writing to directories within the Acronis search path.
- Enforce application allowlisting with Windows Defender Application Control or AppLocker to block execution of unsigned DLLs.
- Audit and remove stale Acronis installation directories from systems that no longer require the product.
# Configuration example: verify Acronis Cyber Protect build on Windows
wmic product where "Name like 'Acronis Cyber Protect%%'" get Name,Version
# Restrict write access to the Acronis program directory for non-admin users
icacls "C:\Program Files\Acronis" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
