Technical impact
Acronis products have a local privilege escalation flaw caused by improper input validation, allowing an attacker with local access to elevate privileges. The vulnerability matches CWE‑123, a type of incorrect input validation that enables unauthorized actions. It can potentially let a malicious user gain administrative rights on a Windows host, compromising confidentiality, integrity, and system availability.
Affected Systems
Acronis DeviceLock DLP for Windows before build 9.0.93212 and Acronis Cyber Protect Cloud Agent for Windows before build 42183 are affected.
Risk and Exploitability
The CVSS score of 7.8 classifies the vulnerability as High severity, indicating significant impact if exploited. The EPSS score is not available, so current exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. The attack likely requires local access to the system and crafting of specific inputs that bypass validation within the agent processes. Given the lack of published exploit, the risk of exploitation is moderate but remains high due to the privileged escalation potential.
