What is the CVSS score of CVE-2026-28727?

CVE-2026-28727 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apple are affected by CVE-2026-28727?

A local privilege escalation vulnerability in Acronis Cyber Protect products on macOS could allow authenticated users to gain elevated system access, potentially compromising backup integrity and…

How to fix or mitigate CVE-2026-28727?

Within 24 hours: Inventory all macOS systems running Acronis Cyber Protect 17 (before build 41186) or Cloud Agent (before build 41124) and assess user access patterns. Within 7 days: Implement network access controls to limit local privilege escalation pathways and monitor for suspicious privilege escalation attempts. Within 30 days: Apply available vendor updates or transition to patched builds (41186+ for Cyber Protect 17, 41124+ for Cloud Agent); prioritize systems with multi-user access.

Apple CVE-2026-28727

HIGH

Incorrect Default Permissions (CWE-276)

2026-03-06 security@acronis.com

Privilege Escalation Apple

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 00:16 nvd

HIGH 7.8

DescriptionCVE.org

Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124.

AnalysisAI

Acronis Cyber Protect and Cloud Agent on macOS before specific builds contain an insecure Unix socket permissions vulnerability that allows local authenticated users to escalate privileges and gain complete system control. An attacker with local access can exploit this misconfiguration to read sensitive data, modify system files, and execute arbitrary commands with elevated rights. No patch is currently available for this HIGH severity vulnerability.

Technical ContextAI

Classified as CWE-276 (Incorrect Default Permissions). Local privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) before build 41186, Acronis Cyber Protect Cloud Agent (macOS) before build 41124.