A local attacker can elevate privileges by placing a malicious DLL in a directory that is searched before the legitimate DLL used by Acronis Cyber Protect. The flaw allows exploitation without direct network access, leveraging Windows DLL search order to load attacker-controlled code with the application's privileges. The vulnerability is a classic path traversal and DLL hijacking issue, catalogued as CWE‑427, and can compromise system integrity if the malicious code is executed with administrative rights.

Acronis Cyber Protect 17 on Windows, versions prior to build 41186 are vulnerable. No other products or vendors are listed as affected in the advisory.

The CVSS base score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not present in the CISA KEV catalog. Based on the description, the attack vector is local; an attacker must already have access to the target machine to place or replace the DLL. The condition for exploitation requires write access to a path in the DLL search order, which is typical for local privilege escalation scenarios.