Acronis products running on macOS provide a Unix socket with permissions that are too permissive, allowing a local user to send specially crafted requests that elevate the process to root privileges. This vulnerability is categorized as CWE-276, Incorrect Default Permissions, and can lead to full system compromise if an attacker gains local access.

The affected products are Acronis Cyber Protect 17 for macOS before build 41186, Acronis Cyber Protect Cloud Agent for macOS before build 41124, and Acronis True Image for macOS before build 42902. Users of these builds on macOS must verify the version and ensure they are running a patched release.

The CVSS score of 7.8 indicates a medium to high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog, which implies it has not yet been widely exploited in the wild. The likely attack vector is local: an attacker who can execute code on the machine must exploit the improper socket permissions. Once accessed, the attacker can gain system-level privileges on the affected macOS instances.