Acronis True Image CVE-2026-27774

The CVSS score of 6.7 reflects a medium-severity local attack with high complexity (AC:H) and user interaction required (UI:R), limiting rapid exploitation. The attack vector is local (AV:L), requiring prior system access, and authentication is required (PR:L), further constraining the threat pool. However, the impact is severe: confidentiality, integrity, and availability are all compromised (C:H/I:H/A:H), meaning successful exploitation grants near-complete system control to the attacker. The requirement for user interaction (UI:R) and high complexity (AC:H) suggest this is not a worm-like propagation vector but rather requires social engineering or precise timing. EPSS data was not provided, but given the local-only attack surface and authentication requirement, real-world exploitation risk is moderate-primarily affecting organizations where non-admin users run Acronis True Image. The absence of KEV status and confirmed POC indicates this is not being actively exploited at scale, making it a priority patch for affected deployments but not an emergency response scenario.

An attacker with low-privilege local access to a Windows system (e.g., a domain user or guest account) observes that Acronis True Image is installed. The attacker places a malicious DLL file in a directory that True Image searches during initialization-such as the application's plugin folder or a user-writable directory in the DLL search path. When a legitimate user (or the same attacker in an elevated context) launches Acronis True Image or triggers a backup operation, the application loads the malicious DLL with the privileges of the running process. If the user has administrative rights or if the Acronis service runs elevated, the attacker gains system-level code execution. The user interaction requirement (UI:R) and high complexity (AC:H) mean this typically requires either waiting for a user to perform a normal action or crafting a plausible social engineering scenario to invoke the vulnerable code path.