Acronis Cyber Protect Cloud Agent
Monthly
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
Local privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud Agent (Windows, builds before 42183) allows a low-privileged local user to escalate to full system control through improper input validation. Classified as CWE-123 (write-what-where condition), successful exploitation yields total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the SSVC technical impact is rated total.
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
Local privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud Agent (Windows, builds before 42183) allows a low-privileged local user to escalate to full system control through improper input validation. Classified as CWE-123 (write-what-where condition), successful exploitation yields total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS is very low (0.01%), but the SSVC technical impact is rated total.