Acronis Cyber Protect EUVD-2025-211205

The attacker must have local, authenticated low-privilege access (PR:L) to a Windows host running Acronis Cyber Protect Cloud Agent before build 42569 or Acronis Cyber Protect 17 before build 42587; the improper-authentication weakness (CWE-1390) in the agent is then abused to escalate privileges. No user interaction is required (UI:N). Limiting factors: there is no remote vector (AV:L), so an attacker needs an existing local foothold; exploitation is confined to the affected Windows builds below the fixed versions; and vendor-rated impact excludes availability (A:N). The specific agent feature, service, or IPC surface that is improperly authenticated is not described in the available sources.

This is a genuinely moderate, local-only issue rather than an emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 7.1 High) establishes that exploitation requires local access by an already-authenticated low-privileged user (PR:L), with no remote vector (AV:L) and no user interaction, yielding high confidentiality and integrity impact but no availability impact. The vuln.today decision label is 'this_week', consistent with a serious-but-not-critical local privilege escalation. No EPSS probability, no CISA KEV listing, and no PoC or exploit reference appear in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One point to verify: although classified as privilege escalation, the vendor set A:N, which is slightly unusual for a full escalation outcome, and the exact post-escalation privilege level and why availability is unaffected are not detailed in the available sources. Net: patch within the vendor's suggested window, but this is not an internet-facing, mass-exploitable flaw.

A local attacker who already holds a low-privileged authenticated session on a Windows host running the Acronis agent abuses the improper authentication flaw in the Cyber Protect agent/service to escalate privileges and read or tamper with protected data and backup operations. No remote access and no user interaction are required, but the attacker must first obtain a local foothold. No public exploit code is identified in the available sources.