CVE-2026-28722: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2026-28722 is a local privilege escalation vulnerability in Acronis Cyber Protect 17 for Windows, caused by improper symbolic (soft) link handling. It affects all builds of Acronis Cyber Protect 17 (Windows) prior to build 41186. The vulnerability was published on March 6, 2026, with a patch made available around March 11, 2026. It carries a CVSS v3.0 base score of 7.3 (High) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), specifically improper handling of symbolic links (soft links) within the Acronis Cyber Protect 17 application on Windows. An attacker with low-privileged local access can craft or manipulate a symbolic link to redirect file operations performed by a higher-privileged process, potentially allowing writes to or reads from sensitive system locations. Exploitation requires local access, low privileges, and user interaction, limiting the attack surface to authenticated local users (Acronis Advisory).

Successful exploitation allows an authenticated local attacker to escalate privileges to a higher level on the affected Windows system, resulting in high impact to confidentiality, integrity, and availability. An attacker could gain unauthorized access to sensitive data, modify system files or configurations, and potentially disrupt system availability. The scope is limited to the affected host, but elevated privileges could facilitate further lateral movement within a network (Acronis Advisory, Red Hat CVE).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Acronis Advisory).

Acronis has released a patch in Acronis Cyber Protect 17 (Windows) build 41186 or later; organizations should upgrade immediately. As interim measures, restrict local system access to trusted and necessary users only, and enforce the principle of least privilege to minimize the risk of exploitation. Monitor systems running affected versions for suspicious privilege escalation activity or unusual symbolic link creation (Acronis Advisory).

Heise reported on multiple vulnerabilities affecting Acronis Cyber Protect business software, noting that numerous vulnerabilities endanger the product (Heise). General community coverage has been limited to automated vulnerability tracking platforms and aggregators, with no notable independent researcher commentary or significant social media discussion identified.