EUVD-2026-21372
GHSA-xr7f-6r6v-cqmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal user crafts malicious environment variables
-
ExploitApplication processes untrusted variable values
-
ExecutionEscalates privileges to system level
-
ImpactExecutes arbitrary code with elevated permissions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Configuration hardening
|
| Exploitation Conditions | Requires local user access to macOS systems running Acronis True Image OEM (before build 42571) or Acronis True Image (before build 42902). Attacker with low-privilege local user account can escalate privileges by manipulating environment variables without requiring user interaction. |
| Impact | High-impact local privilege escalation affecting Acronis True Image on macOS. CVSS 7.8 reflects high confidentiality, integrity, and availability impact. Attack requires local access and low privileges, realistic for compromised user accounts. Blast radius limited to affected systems; patches available. Priority for Acronis users, particularly OEM deployments. |
| Exploit ScenarioDerived | Authenticated local attacker manipulates environment variables to escalate privileges during Acronis True Image execution. Leverages improper variable handling (CWE-15) to gain high-level access without user interaction. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Local privilege escalation in Acronis True Image for macOS enables authenticated low-privileged users to gain elevated system privileges through improper environment variable handling. Affects Acronis True Image OEM (macOS) versions prior to build 42571 and Acronis True Image (macOS) prior to build 42902. Attackers with existing local access can achieve complete system compromise (high confidentiality, integrity, and availability impact). No public exploit identified at time of analysis. Exploitation requires low attack complexity with no user interaction.
RemediationAI
Vendor-released patches: upgrade Acronis True Image OEM (macOS) to build 42571 or later, and Acronis True Image (macOS) to build 42902 or later. Obtain updates through Acronis official channels or enable automatic update mechanisms within the application. Full vendor advisory available at https://security-advisory.acronis.com/advisories/SEC-9407. Until patching is complete, restrict local user privileges on affected macOS systems, enforce principle of least privilege, audit environment variable configurations, and monitor for suspicious privilege escalation attempts. No effective workarounds exist; patching is the only complete mitigation. Prioritize systems with multiple local users or shared access environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause stems from CWE-15 (External Control of System or Configuration Setting) where inadequate sanitization of environment variables allows authenticated local users to manipulate system configuration settings. CVSS vector PR:L indicates exploitation requires low-privilege local credentials. Attack chain leverages environment variable injection to escalate privileges without additional access barriers (AC:L), resulting in complete scope breach across confidentiality, integrity, and availability domains.
Know when Acronis True Image gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Acronis) · only source for this CVE.
CVSS VectorVendor: Acronis
Lifecycle Timeline
3DescriptionCVE.org
Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.
Executive ViewAI
Acronis True Image for macOS contains a local privilege escalation vulnerability (CVE-2026-33092, CVSS 7.8) that allows authenticated users with existing system access to gain administrative privileges and achieve full system compromise. This affects all users running True Image OEM prior to build 42571 and True Image prior to build 42902, creating a critical insider threat and endpoint security risk that must be remediated immediately.
Apply vendor patch. Until patched: restrict local system access to trusted users only, enforce mandatory access controls limiting low-privileged user capabilities, monitor privileged account usage and system calls from Acronis True Image processes, and consider temporarily disabling True Image on non-critical systems if patch deployment cannot be completed within 7 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Acronis True Image
View allLocal privilege escalation in Acronis True Image (Windows) before build 42902 allows authenticated users with low privil
Local privilege escalation in Acronis True Image for Windows before build 42902 exploits DLL hijacking to allow authenti
Local privilege escalation in Acronis True Image for Windows before build 42902 allows authenticated users with low priv
Exploit-DB