The vulnerability arises because Acronis Virtual Appliance contains a default credentials set for a local privileged user. If an attacker can authenticate with these default credentials, they may gain privileged access to the appliance. This flaw permits local privilege escalation, which could potentially affect confidentiality, integrity, or availability of the protected environment.

Affected systems include Acronis Cyber Protect 17 (VMware) with build numbers below 41186 and Acronis Cyber Protect Cloud Agent (VMware) with build numbers below 36943, representing virtual appliances that expose default credentials.

The CVSS base score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. It is likely that exploitation requires local access to the virtual appliance; an attacker would need to reach the appliance’s management interface and then authenticate with the default credentials. Once authenticated, the attacker could potentially perform privileged operations, making this a high-impact local privilege escalation.