CVE-2026-28721: Acronis Cyber Protect Privilege Escalation

CVE-2026-28721 Overview

CVE-2026-28721 is a local privilege escalation vulnerability affecting Acronis Cyber Protect 17 on Windows systems. The vulnerability stems from improper handling of soft links (symbolic links), which allows a local attacker with limited privileges to escalate their access to higher privilege levels. This type of symlink attack exploits the application's failure to properly validate or restrict symbolic link operations, potentially enabling attackers to manipulate file operations performed by privileged processes.

Critical Impact

A local attacker with low privileges can exploit improper soft link handling to achieve high-impact compromise of system confidentiality, integrity, and availability on affected Windows systems running Acronis Cyber Protect 17.

Affected Products

• Acronis Cyber Protect 17 (Windows) before build 41186
• Microsoft Windows (as the underlying operating system platform)

Discovery Timeline

• 2026-03-06 - CVE-2026-28721 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28721

Vulnerability Analysis

This vulnerability is classified under CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), which describes situations where an application uses external input to access resources but fails to properly neutralize that input, allowing attackers to reference resources in unintended ways.

In the context of Acronis Cyber Protect 17, the application performs file operations with elevated privileges but does not adequately verify whether file paths involve symbolic links that could redirect those operations to unintended locations. When the software follows a maliciously crafted symbolic link, it may inadvertently modify, read, or execute files in privileged directories that the attacker would not normally have access to.

The vulnerability requires local access to the system and user interaction, meaning an attacker must already have a foothold on the target machine and must craft conditions that trigger the vulnerable code path.

Root Cause

The root cause of CVE-2026-28721 lies in insufficient validation of file paths during operations performed by privileged Acronis Cyber Protect processes. The software fails to properly check whether a file path resolves through symbolic links to locations outside the expected directory scope. This allows a local user to create symbolic links that redirect file operations to sensitive system files or directories, effectively leveraging the application's elevated privileges to perform unauthorized actions.

Attack Vector

The attack vector is local, requiring the attacker to have an existing account on the target Windows system. The exploitation scenario typically involves:

1. The attacker identifies a file operation performed by Acronis Cyber Protect with elevated privileges
2. The attacker creates a symbolic link (soft link) in a location they control, pointing to a sensitive system file or directory
3. When the Acronis service performs its privileged operation, it follows the symbolic link and inadvertently operates on the attacker-controlled target
4. This can result in arbitrary file writes, overwrites, or other operations that compromise system security

The vulnerability can lead to full compromise of confidentiality, integrity, and availability on the affected system. For detailed technical information, refer to the Acronis Security Advisory SEC-8445.

Detection Methods for CVE-2026-28721

Indicators of Compromise

• Unexpected symbolic links appearing in directories associated with Acronis Cyber Protect operations
• Anomalous file modifications in system directories (C:\Windows\System32, C:\Program Files) by Acronis processes
• Creation of junction points or symbolic links by non-administrative users in application directories
• Unusual process behavior from Acronis services including accessing unexpected file paths

Detection Strategies

• Monitor for symbolic link creation events using Windows Security Event Logs and Sysmon (Event ID 11 for file creation)
• Implement file integrity monitoring on critical Acronis Cyber Protect installation directories
• Use endpoint detection solutions to alert on privilege escalation patterns involving symlink manipulation
• Review process execution chains for Acronis services to identify anomalous file access patterns

Monitoring Recommendations

• Enable verbose logging for Acronis Cyber Protect services and correlate with Windows event logs
• Configure SentinelOne to detect symlink abuse patterns and privilege escalation attempts
• Monitor for unusual child process spawning from Acronis-related executables
• Track file system activity in temporary directories commonly used by Acronis operations

How to Mitigate CVE-2026-28721

Immediate Actions Required

• Update Acronis Cyber Protect 17 to build 41186 or later immediately
• Review systems for any unauthorized symbolic links in Acronis-related directories
• Restrict local user permissions to prevent symbolic link creation in sensitive directories where possible
• Implement application allowlisting to prevent unauthorized code execution following potential exploitation

Patch Information

Acronis has released a security update addressing this vulnerability in Acronis Cyber Protect 17 build 41186. Organizations should apply this update as soon as possible. Detailed patch information is available in the Acronis Security Advisory SEC-8445.

The patch implements proper symbolic link validation to ensure that file operations performed by privileged processes cannot be redirected through malicious symlinks to unintended locations.

Workarounds

• Limit local access to systems running vulnerable versions of Acronis Cyber Protect to trusted users only
• Implement strict user account controls and principle of least privilege for all local accounts
• Use Windows Group Policy to restrict symbolic link creation capabilities for standard users
• Monitor and alert on any symlink creation activity in Acronis installation and working directories

# Windows PowerShell - Check Acronis Cyber Protect version
Get-ItemProperty "HKLM:\SOFTWARE\Acronis\*" | Select-Object DisplayName, DisplayVersion

# Restrict symbolic link creation via Group Policy (requires administrative privileges)
# Configure: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment
# Remove users from "Create symbolic links" privilege where not required