A local privilege escalation vulnerability exists in Acronis Cyber Protect 17 for Windows. The flaw stems from improper handling of symbolic links, allowing a local user to manipulate file paths in a way that elevates privileges. Because the vulnerability is classified as CWE‑610, it involves authorization bypass by accessing or writing to file objects that should be protected. The impact is the ability of an attacker with local access to read or modify privileged files, thereby compromising system integrity and confidentiality.

Acronis Cyber Protect 17 running on Windows operating systems, specifically versions released before build 41186. No other vendors or product lines are mentioned in the CVE data.

The CVSS score of 7.3 places the vulnerability in the high severity range, but the EPSS score of less than 1% indicates that exploitation is unlikely in the short term. The CVE is not listed in the CISA KEV catalog, further reducing immediate threat. Attacks would require local access and the creation or manipulation of symbolic links, meaning only a user with some local privileges could exploit it. Once the flaw is leveraged, the attacker can elevate privileges within the system, potentially enabling further compromise.