What is the CVSS score of CVE-2026-28721?

CVE-2026-28721 has a CVSS 3.0 base score of 7.3 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-28721?

A local privilege escalation vulnerability in Acronis Cyber Protect 17 (Windows) allows authenticated users to gain elevated system access through improper symbolic link handling.

How to fix or mitigate CVE-2026-28721?

Within 24 hours: Identify all systems running Acronis Cyber Protect 17 (Windows) build 41186 or earlier and document exposure. Within 7 days: Implement network segmentation to restrict local access to Acronis services, disable unnecessary local account privileges, and enforce multi-factor authentication for administrative access. Within 30 days: Contact Acronis for patch availability status and timeline; evaluate alternative backup solutions if patch remains unavailable; implement enhanced endpoint monitoring for privilege escalation attempts.

Windows CVE-2026-28721

HIGH

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

2026-03-06 security@acronis.com

Windows Privilege Escalation Cyber Protect Acronis

7.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 00:16 nvd

HIGH 7.3

DescriptionCVE.org

Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.

AnalysisAI

Acronis Cyber Protect 17 for Windows before build 41186 allows local attackers with standard user privileges to escalate to system-level access through improper handling of symbolic links. An authenticated attacker can exploit this vulnerability to gain full control over the affected system, including the ability to read, modify, or delete sensitive data and execute arbitrary code. No patch is currently available for this vulnerability.

Technical ContextAI

Affects Cyber Protect. Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.