CVE-2026-28722: Acronis Cyber Protect Privilege Escalation

CVE-2026-28722 Overview

CVE-2026-28722 is a local privilege escalation vulnerability in Acronis Cyber Protect 17 for Windows. The flaw stems from improper soft link (symbolic link) handling [CWE-610]. A local authenticated attacker can abuse this weakness to elevate privileges on the affected host. Successful exploitation grants high impact to confidentiality, integrity, and availability. The vulnerability affects Acronis Cyber Protect 17 (Windows) builds prior to 41186. Acronis has published advisory SEC-8481 addressing the issue.

Critical Impact
A local authenticated user can leverage symbolic link handling flaws in Acronis Cyber Protect 17 to gain elevated privileges on Windows systems, leading to full host compromise.

Affected Products

Acronis Cyber Protect 17 (Windows) before build 41186
Microsoft Windows (as the underlying operating system)
Acronis Cyber Protect product family on Windows platforms

Discovery Timeline

2026-03-06 - CVE-2026-28722 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-28722

Vulnerability Analysis

The vulnerability is a symbolic link (symlink) handling flaw classified under [CWE-610] Externally Controlled Reference to a Resource in Another Sphere. Acronis Cyber Protect 17 runs privileged components on Windows that interact with files or directories without sufficient validation of soft links. A low-privileged local user can plant a symbolic link or junction in a location the privileged process subsequently accesses. When the service follows the attacker-controlled link, it performs file operations such as write, delete, or overwrite under the security context of the elevated process.

The attack requires local access, low privileges, and user interaction, according to the CVSS metrics published in NVD. The scope is unchanged, but the impact on confidentiality, integrity, and availability is high because the abused process executes with SYSTEM or other elevated rights. Acronis tracks the issue in advisory SEC-8481 and has corrected the behavior in build 41186.

Root Cause

The root cause is improper validation of file system links before performing privileged file operations. The vulnerable code does not check whether a target path is a reparse point, symbolic link, or NTFS junction prior to following it. This allows redirection of privileged I/O to attacker-chosen locations on disk.

Attack Vector

The attack vector is local. An authenticated user prepares a writable directory, creates a junction or symbolic link pointing to a sensitive system or application path, and then triggers an Acronis Cyber Protect operation that touches the staged location. The privileged service follows the link and writes to, deletes, or overwrites the target, enabling privilege escalation.

No verified proof-of-concept code is publicly available. See the Acronis Security Advisory SEC-8481 for vendor technical detail.

Detection Methods for CVE-2026-28722

Indicators of Compromise

Creation of NTFS junctions or symbolic links by non-administrative users in directories accessed by Acronis Cyber Protect services.
File writes, deletions, or permission changes performed by Acronis service processes against unexpected system paths.
Acronis Cyber Protect 17 installations on Windows reporting a build number lower than 41186.

Detection Strategies

Monitor process telemetry for Acronis service binaries opening or modifying files outside their installation, working, and backup directories.
Audit reparse point creation events (Windows Sysmon Event ID 11 with reparse attributes, or EDR file-create telemetry) initiated by standard user accounts.
Correlate user-mode mklink, CreateSymbolicLink, or DeviceIoControl (FSCTL_SET_REPARSE_POINT) activity with subsequent privileged file operations on the same path.

Monitoring Recommendations

Enable Windows object access auditing on directories used by Acronis Cyber Protect for staging, logging, and updates.
Track installed Acronis Cyber Protect 17 build versions across the fleet through software inventory and flag any host below build 41186.
Alert on local privilege escalation patterns: a low-privileged process creating links followed by SYSTEM writes to those links within a short time window.

How to Mitigate CVE-2026-28722

Immediate Actions Required

Upgrade Acronis Cyber Protect 17 on Windows to build 41186 or later as published in advisory SEC-8481.
Restrict interactive and remote logon rights on systems running Acronis Cyber Protect to trusted administrators only.
Review and tighten NTFS permissions on directories that Acronis services read from or write to, removing write access for standard users.

Patch Information

Acronis has released a fixed build of Cyber Protect 17 for Windows that corrects the symbolic link handling logic. Apply build 41186 or later. Refer to the Acronis Security Advisory SEC-8481 for download links and verification guidance.

Workarounds

If patching is not immediately possible, limit the set of users with local logon rights on hosts running Acronis Cyber Protect 17.
Enforce least privilege on directories accessed by Acronis services so that non-administrative users cannot create reparse points within them.
Monitor Acronis service activity with endpoint detection tooling and investigate any file operations targeting system-critical paths.

bash

# Example: enumerate Acronis Cyber Protect build on a Windows host
# Run in an elevated PowerShell session
Get-ItemProperty 'HKLM:\SOFTWARE\Acronis\*' |
    Select-Object PSChildName, ProductName, ProductVersion, Build |
    Format-Table -AutoSize

# Flag hosts running a build lower than 41186 for immediate upgrade