Acronis True Image CVE-2026-28728

The CVSS 6.7 score with AV:L, AC:H, PR:L, UI:R reflects a medium-severity local privilege escalation with meaningful preconditions: the attacker must already have local access, valid credentials (PR:L), and must convince or wait for a user to trigger the vulnerable code path (UI:R). The high complexity (AC:H) suggests environmental factors or timing constraints increase difficulty. The EPSS value and KEV status are not provided in available data, limiting dynamic exploitation-probability assessment. However, the combination of AV:L and PR:L means this is primarily a threat in multi-user or shared-system environments where lateral privilege escalation matters-e.g., a standard user escalating to admin. The real-world risk is moderate: while privilege escalation to system-level access (C:H, I:H, A:H) is severe if successful, the attack complexity and user-interaction requirement reduce the likelihood of opportunistic or automated exploitation. This is a legitimate priority for patching but lower urgency than network-remotely-exploitable flaws.

An attacker with local access to a Windows system (e.g., a standard user account on a shared machine) identifies that Acronis True Image loads a specific DLL from a user-writable directory before checking system directories. The attacker places a malicious DLL with the same name in a location Acronis will search first. When a legitimate user (or the attacker, if they can wait) launches Acronis or triggers a backup/imaging feature, the application loads the attacker's DLL with the user's privileges. If the user is an administrator, the attacker gains system-level code execution; if not, the attacker escalates from a standard user to admin privileges via DLL-executed payload. User interaction is required-the application must be actively used-making this vulnerability exploitable in environments where Acronis is regularly used by higher-privileged accounts.