CVE-2026-28717: Acronis Cyber Protect Privilege Escalation

CVE-2026-28717 Overview

CVE-2026-28717 is a local privilege escalation vulnerability affecting Acronis Cyber Protect 17 on Windows systems. The vulnerability stems from improper directory permissions (CWE-276: Incorrect Default Permissions) that allow a local attacker with limited privileges to escalate their access and potentially compromise system integrity.

This vulnerability affects Acronis Cyber Protect 17 (Windows) before build 41186. The improper permissions configuration allows authenticated local users to manipulate protected directories, potentially leading to unauthorized system modifications.

Critical Impact

Local attackers can exploit insecure directory permissions to achieve privilege escalation, potentially compromising data integrity on affected Windows systems running vulnerable versions of Acronis Cyber Protect.

Affected Products

• Acronis Cyber Protect 17 (Windows) before build 41186
• Microsoft Windows (as the underlying operating system platform)

Discovery Timeline

• 2026-03-06 - CVE-2026-28717 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28717

Vulnerability Analysis

This vulnerability falls under the category of Insecure Permissions (CWE-276: Incorrect Default Permissions). The flaw exists in how Acronis Cyber Protect 17 configures directory permissions during installation or runtime operations on Windows systems.

The attack requires local access to the system and user interaction, meaning an attacker must already have some level of authenticated access to the target machine. While the vulnerability does not allow for data exfiltration (no confidentiality impact), it provides a pathway for unauthorized modifications to protected resources, representing a significant integrity concern.

The local attack vector combined with low complexity requirements means that once an attacker gains initial foothold on a system, exploitation is relatively straightforward. This makes the vulnerability particularly concerning in enterprise environments where insider threats or compromised user accounts could leverage this flaw for lateral movement or persistence.

Root Cause

The root cause of CVE-2026-28717 is improper directory permission configuration in Acronis Cyber Protect 17 for Windows. Specifically, the application sets overly permissive access controls on certain directories, allowing users with limited privileges to modify files or directories that should be protected from non-administrative access.

This type of misconfiguration typically occurs when:

• Installation routines fail to properly restrict directory ACLs
• Service directories inherit overly permissive parent permissions
• Temporary or cache directories are created with insecure defaults

Attack Vector

The attack vector for CVE-2026-28717 is local, requiring an attacker to have authenticated access to the affected Windows system. The exploitation scenario involves:

1. An attacker with a low-privileged local account identifies directories with improper permissions
2. The attacker leverages the misconfigured permissions to modify protected files or plant malicious content
3. When the Acronis Cyber Protect service or a privileged process accesses the modified content, the attacker achieves privilege escalation

The vulnerability requires user interaction, which may involve triggering specific application functions or waiting for scheduled operations that process the attacker-controlled content.

For detailed technical information about this vulnerability, refer to the Acronis Security Advisory SEC-8363.

Detection Methods for CVE-2026-28717

Indicators of Compromise

• Unexpected permission changes on Acronis Cyber Protect installation directories
• Unauthorized modifications to files within the Acronis application directories
• Presence of new or modified executables in directories typically managed by Acronis services
• Evidence of local privilege escalation attempts in Windows Security Event logs

Detection Strategies

• Monitor Windows Security Event logs for permission changes (Event IDs 4670, 4663) on Acronis-related directories
• Deploy file integrity monitoring (FIM) solutions to detect unauthorized modifications to Acronis installation directories
• Audit local user activities for suspicious access patterns to protected system directories
• Implement endpoint detection rules to identify privilege escalation attempts following directory manipulation

Monitoring Recommendations

• Enable auditing on Acronis Cyber Protect installation directories to track access and modification attempts
• Configure SentinelOne agents to monitor for behavioral indicators of privilege escalation on endpoints running Acronis software
• Establish baseline permissions for Acronis directories and alert on deviations
• Review Windows Security logs regularly for anomalous local account activity targeting backup and protection software

How to Mitigate CVE-2026-28717

Immediate Actions Required

• Update Acronis Cyber Protect 17 to build 41186 or later immediately
• Audit current directory permissions on Acronis installation paths to identify potential misconfigurations
• Review local user accounts for any unauthorized privilege changes that may indicate prior exploitation
• Implement the principle of least privilege for all local user accounts on systems running Acronis Cyber Protect

Patch Information

Acronis has released a security update addressing this vulnerability. Organizations should upgrade to Acronis Cyber Protect 17 build 41186 or later to remediate CVE-2026-28717.

For official patch details and download information, refer to the Acronis Security Advisory SEC-8363.

Workarounds

• Manually review and restrict permissions on Acronis Cyber Protect installation directories pending patch deployment
• Implement application whitelisting to prevent execution of unauthorized binaries in Acronis directories
• Limit local user account privileges to reduce the attack surface for privilege escalation
• Deploy additional endpoint monitoring to detect exploitation attempts until patching is complete

# Review current permissions on Acronis directories (Windows PowerShell)
Get-Acl "C:\Program Files\Acronis" | Format-List

# Restrict permissions to administrators only (temporary workaround)
icacls "C:\Program Files\Acronis" /inheritance:r /grant:r "BUILTIN\Administrators:(OI)(CI)F" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"