Local privilege escalation due to improper soft link handling

CVE-2026-28722 is a local privilege escalation in Acronis Cyber Protect 17 for Windows caused by improper soft link handling. The affected range is Acronis Cyber Protect 17 (Windows) before build 41186. In plain terms, a low-privileged local user can try to steer a privileged Acronis operation into following an attacker-controlled link and touching files or locations it should never trust, with the end goal of executing or writing as a more privileged context.

The vendor's HIGH 7.3 score is technically defensible in a lab, but it overstates the enterprise patch urgency in the real world. This bug is not remote, not pre-auth, not wormable, not KEV-listed, has very low EPSS, and even the CNA vector includes local access, low privileges, and user interaction. That is classic *post-compromise* territory: valuable for ransomware operators after foothold, but not a reason to blow up your whole patch calendar.

Why this verdict

• Down from vendor HIGH: AV:L/PR:L/UI:R is not a street-facing attack path; it starts after the attacker is already on the host.
• Further downward pressure: user interaction is required, which materially reduces reliability and mass exploitation value.
• No threat amplifiers present: no KEV listing, no public PoC found, and the supplied EPSS is near zero.
• But not LOW: backup/security software often runs highly privileged, so a local LPE in this product can still be very useful to ransomware operators once they have a beachhead.
• Blast radius is bounded: impact is severe on one machine, but the flaw does not create domain-wide or fleet-wide compromise by itself.

Why not higher?

A higher rating would require a broader reachable population or stronger threat evidence: remote reachability, no-auth abuse, active exploitation, or a dependable public exploit. None of those are present here. Every major prerequisite — local access, low privileges, and user interaction — narrows the attack population and compounds the downgrade.

Why not lower?

This is still privilege escalation in a product that commonly runs with elevated rights on operationally sensitive systems. On backup servers, management nodes, or admin workstations, turning a user foothold into SYSTEM can be consequential. Even without internet exposure, that makes it more than simple backlog lint.

1. Restrict local logon paths — Reduce the set of users who can reach Acronis-managed Windows hosts interactively or via remote desktop. Because the reassessed verdict is MEDIUM, there is no mitigation SLA — but do this during normal hardening work so local footholds are harder to convert into privilege escalation.
2. Tighten symlink and reparse-point abuse opportunities — Review developer-mode use, local policy, and writable directories that low-privileged users can control on Acronis hosts. The goal is to make attacker-controlled link creation and privileged path redirection harder while you work through patching; again, no mitigation SLA for this severity, so fold it into baseline Windows hardening.
3. Watch Acronis processes with EDR — Alert on Acronis services writing outside expected directories, launching unexpected child processes, or touching protected files. This is the most realistic compensating control for a post-compromise LPE because it targets the behavior that turns a foothold into SYSTEM.
4. Prioritize sensitive Acronis roles first — If you cannot patch all endpoints at once, move backup servers, management servers, and admin workstations with Acronis to the front of the line. Those machines have the highest blast radius if a local user or malware gains SYSTEM.

Run this on the target Windows host or through your endpoint management tool. Example: powershell -ExecutionPolicy Bypass -File .\check-acronis-cve-2026-28722.ps1. It needs standard read access to the local registry and filesystem; administrative rights are not usually required.

# check-acronis-cve-2026-28722.ps1

# Detects whether Acronis Cyber Protect 17 for Windows is below fixed build 41186.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedBuild = 41186

function Get-UninstallEntries {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    $items = foreach ($p in $paths) {
        Get-ItemProperty -Path $p | Where-Object {
            $_.DisplayName -match 'Acronis Cyber Protect 17'
        }
    }

    return $items
}

function Get-BuildFromString([string]$s) {
    if ([string]::IsNullOrWhiteSpace($s)) { return $null }

    # Prefer the last 4-6 digit number in the string, which typically matches the build.

    $matches = [regex]::Matches($s, '(\d{4,6})')
    if ($matches.Count -gt 0) {
        return [int]$matches[$matches.Count - 1].Value
    }

    return $null
}

function Get-FileBuildHints {
    $candidatePaths = @(
        'C:\Program Files\Acronis',
        'C:\Program Files (x86)\Acronis'
    )

    foreach ($base in $candidatePaths) {
        if (Test-Path $base) {
            $files = Get-ChildItem -Path $base -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | Select-Object -First 50
            foreach ($f in $files) {
                $ver = $f.VersionInfo.ProductVersion
                $b = Get-BuildFromString $ver
                if ($b) {
                    return $b
                }
            }
        }
    }

    return $null
}

$entries = Get-UninstallEntries

if (-not $entries -or $entries.Count -eq 0) {
    Write-Output 'UNKNOWN'
    exit 2
}

$detectedBuilds = @()
foreach ($entry in $entries) {
    $build = $null

    if ($entry.DisplayVersion) {
        $build = Get-BuildFromString $entry.DisplayVersion
    }

    if (-not $build -and $entry.PSChildName) {
        $build = Get-BuildFromString $entry.PSChildName
    }

    if ($build) {
        $detectedBuilds += $build
    }
}

if ($detectedBuilds.Count -eq 0) {
    $fallbackBuild = Get-FileBuildHints
    if ($fallbackBuild) {
        $detectedBuilds += $fallbackBuild
    }
}

if ($detectedBuilds.Count -eq 0) {
    Write-Output 'UNKNOWN'
    exit 2
}

$lowestBuild = ($detectedBuilds | Measure-Object -Minimum).Minimum

if ($lowestBuild -lt $fixedBuild) {
    Write-Output 'VULNERABLE'
    exit 1
}
else {
    Write-Output 'PATCHED'
    exit 0
}

Sources

1. NVD CVE-2026-28722
2. Acronis advisory SEC-8481
3. Acronis Cyber Protect 17 update UPD-2510-e871-9553
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. OpenCVE record
8. JVNDB mirror entry