Acronis Cyber Protect 17 contains a DLL hijacking vulnerability that allows an attacker with local access to execute arbitrary code with elevated privileges. The flaw is tied to missing validation of the DLL loading path, making it possible to replace a legitimate library with a malicious variant. The weakness is classified as CWE-427, leading to privilege escalation, integrity breach, and potential system compromise.

Acronis Cyber Protect 17 for Windows, versions prior to build 41186, are affected. The vulnerability is present in all revisions of this product before the specified build and applies to Windows operating systems used with the software.

The CVSS score of 6.3 categorizes the risk as medium, while the EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread attacks. Exploitation requires local access to the target system and the ability to place a malicious DLL in the directory examined by the application. Attackers would need administrative or at least write permissions to the installation directory or its search path, making this a local privilege escalation vector.