CVE-2026-28727: 
Acronis Cyber Protect vulnerability analysis and mitigation

CVE-2026-28727 is a local privilege escalation vulnerability caused by insecure Unix socket permissions in multiple Acronis products on macOS. It affects Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124, and Acronis True Image (macOS) before build 42902. The vulnerability was published on March 6, 2026, with a patch advisory released by Acronis. It carries a CVSS v3.0 base score of 7.8 (High) (Acronis Advisory, Red Hat CVE).

The root cause is classified as CWE-276 (Incorrect Default Permissions), where Unix socket files used by Acronis services on macOS are created with overly permissive access controls. A low-privileged local user can interact with these sockets to send commands or requests that are processed with elevated privileges, enabling privilege escalation to root without requiring user interaction. The attack vector is local, requires only low privileges, and has low attack complexity, making it straightforward to exploit once local access is obtained (Acronis Advisory, Feedly).

Successful exploitation allows a low-privileged local user to escalate to root on affected macOS systems, resulting in complete system compromise. This grants full confidentiality, integrity, and availability impact — an attacker can access all system data, manipulate files and configurations, install persistent malware, and disrupt system availability. The scope is limited to the affected host, but root access could facilitate further lateral movement within a network environment (Acronis Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the affected macOS system with at least low-privilege credentials (Acronis Advisory, Feedly).

1. Gain Local Access: Obtain a low-privileged user account on a macOS system running a vulnerable version of Acronis Cyber Protect 17 (before build 41186), Acronis Cyber Protect Cloud Agent (before build 41124), or Acronis True Image (before build 42902).
2. Identify Vulnerable Unix Sockets: Enumerate Unix domain socket files associated with Acronis services (e.g., using find /var/run /tmp -name '*.sock' 2>/dev/null or lsof -U) and check their permissions for world-readable/writable access.
3. Interact with the Socket: Send crafted commands or requests to the insecurely permissioned Unix socket using tools such as nc -U <socket_path> or a custom script, targeting privileged operations exposed by the Acronis service.
4. Achieve Privilege Escalation: Leverage the service's elevated execution context to run arbitrary commands as root, such as adding a new privileged user, installing a backdoor, or executing a reverse shell with root privileges (Acronis Advisory).

• File System: Unexpected modification of Unix socket files in /var/run or application-specific directories associated with Acronis services; new files or scripts created in privileged directories by non-root users.
• Logs: macOS system logs (/var/log/system.log or unified logging via log show) showing low-privileged processes communicating with Acronis service sockets; unexpected privilege escalation events in security audit logs.
• Process: Unusual processes spawned as root from non-root parent processes; Acronis service processes (aakore, acronis_agent, or similar) spawning unexpected child processes such as shells or network utilities.
• Network: Outbound connections from the macOS host to unknown external IPs initiated by root-level processes shortly after Acronis service interaction.

Acronis has released patches addressing this vulnerability. Users should update to the following minimum builds: Acronis Cyber Protect 17 (macOS) build 41186 or later, Acronis Cyber Protect Cloud Agent (macOS) build 41124 or later, and Acronis True Image (macOS) build 42902 or later. As interim mitigations, administrators should restrict local system access to trusted users only and audit Unix socket permissions on affected endpoints. Monitoring for privilege escalation attempts on macOS systems running Acronis software is also recommended (Acronis Advisory).

Heise reported on the vulnerability as part of broader coverage of multiple vulnerabilities affecting Acronis Cyber Protect business software (Heise). The vulnerability received limited social media attention, with mentions on Bluesky and Mastodon from security-focused accounts. Community sentiment reflects low urgency given the absence of public exploits and the local-only attack vector, though patching is still recommended given the high impact of successful exploitation.