CVE-2026-28721

Executive Summary

CVE-2026-28721 is a local privilege escalation vulnerability in Acronis Cyber Protect 17 (Windows) before build 41186. The vulnerability arises from improper handling of symbolic links (soft links), allowing a low-privileged attacker to perform a symlink attack to escalate privileges to SYSTEM. The CVSS score is 7.3 (High), and the attack vector is local. No public proof-of-concept (PoC) or exploit code has been identified at this time. The vendor has released a fix in build 41186.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows application (Acronis Cyber Protect 17). Supply chain risk is limited to the integrity of the vendor's update distribution channel.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a standard user account.
• User Interaction (UI): None (N) – No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: High. While the attack is local, the low privileges required and the potential for full system compromise make this a significant threat in multi-user environments or where attackers have already gained a foothold.

Deep Dive & Mechanics

The vulnerability is a classic symlink (soft link) race condition or improper link resolution issue (CWE-59). Acronis Cyber Protect 17, when performing privileged operations (e.g., file operations, service actions), does not properly validate the target of symbolic links. A low-privileged attacker can create a symbolic link pointing from a location the vulnerable process writes to (e.g., a temporary directory) to a critical system file (e.g., C:\Windows\System32\config\SAM or a privileged executable).

When the Acronis service (running as SYSTEM) follows the symlink, it performs an operation (write, delete, or move) on the attacker-controlled target, leading to privilege escalation. The exact vulnerable component is not publicly detailed, but it likely involves file operations during backup, restore, or update processes.

Attack Scenario:

1. Attacker gains a low-privileged shell on a Windows system running Acronis Cyber Protect 17 (pre-build 41186).
2. Attacker identifies a directory writable by the Acronis service (e.g., C:\ProgramData\Acronis\Temp).
3. Attacker creates a symbolic link in that directory pointing to a SYSTEM-protected file (e.g., C:\Windows\System32\drivers\etc\hosts or a service binary).
4. Attacker triggers the vulnerable Acronis operation (e.g., a backup job or update check).
5. The Acronis service, running as SYSTEM, follows the symlink and overwrites the target file, allowing the attacker to execute arbitrary code as SYSTEM.

Vulnerable vs. Patched Code

Since the exact source code is proprietary, the following is a conceptual representation of the vulnerability.

Vulnerable Code (Conceptual):

// Vulnerable: Does not check if the target is a symlink
void ProcessFile(const char* path) {
    // Assume path is a regular file
    FILE* f = fopen(path, "w");
    if (f) {
        // Write privileged data
        fwrite(data, 1, size, f);
        fclose(f);
    }
}

Patched Code (Conceptual):

// Patched: Uses Windows API to check for reparse points
void ProcessFile(const char* path) {
    WIN32_FIND_DATA findData;
    HANDLE hFind = FindFirstFile(path, &findData);
    if (hFind != INVALID_HANDLE_VALUE) {
        // Check for reparse point (symlink)
        if (findData.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) {
            // Log and reject
            LogError("Symlink detected, aborting.");
            FindClose(hFind);
            return;
        }
        FindClose(hFind);
    }
    // Proceed with safe file operation
    FILE* f = fopen(path, "w");
    if (f) {
        fwrite(data, 1, size, f);
        fclose(f);
    }
}

Exploitation & Lab Setup

Red Team

Objective: Escalate from a low-privileged user to SYSTEM.

Prerequisites:

• Windows 10/11 or Windows Server 2016/2019/2022.
• Acronis Cyber Protect 17 (build < 41186) installed.
• Low-privileged shell (e.g., via phishing or another vulnerability).

Steps:

1. Identify writable directory: Find a directory writable by the Acronis service. Common locations:
   • C:\ProgramData\Acronis\Temp
   • C:\Windows\Temp
2. Create symlink: Use mklink (requires SeCreateSymbolicLinkPrivilege, often granted to standard users on older Windows versions) or a tool like NtCreateSymbolicLinkObject. If mklink is not available, use PowerShell:

   New-Item -ItemType SymbolicLink -Path "C:\ProgramData\Acronis\Temp\target.txt" -Target "C:\Windows\System32\drivers\etc\hosts"
   

3. Trigger vulnerable operation: Initiate a backup or update operation via the Acronis GUI or CLI:

   "C:\Program Files\Acronis\CyberProtect\acronis_agent.exe" --trigger-update
   

4. Verify escalation: After the operation, check if the target file (hosts) has been overwritten. If successful, the attacker can modify the file to redirect traffic or execute code.

Note: No public exploit code is available. The above is a theoretical exploitation path.

Blue Team

Detection:

• Monitor for creation of symbolic links in C:\ProgramData\Acronis\Temp or other Acronis directories.
• Monitor for unusual file writes to system-protected locations (e.g., C:\Windows\System32\drivers\etc\hosts).
• Enable Windows Event Logging for file creation and symlink events (Event ID 4663).

Mitigation:

• Apply the vendor patch (build 41186 or later).
• Restrict the SeCreateSymbolicLinkPrivilege to administrators only.
• Use AppLocker or Windows Defender Application Control to block unauthorized executables.
• Monitor Acronis service logs for errors related to file operations.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected symbolic links in C:\ProgramData\Acronis\Temp\ or C:\Windows\Temp\.
  • Modified system files (e.g., hosts, SAM, service binaries).
• Process:
  • acronis_agent.exe or acronis_service.exe performing writes to unusual paths.
• Event Logs (Windows):
  • Event ID 4663: An attempt was made to access an object (with AccessMask indicating write).
  • Event ID 4656: A handle to an object was requested.
  • Event ID 1 (Sysmon): Process creation with command lines containing mklink or New-Item -ItemType SymbolicLink.
• Network:
  • Unusual outbound connections from the Acronis process (if the attacker modifies hosts to redirect traffic).

Detection Engineering

YARA Rule

rule CVE_2026_28721_Symlink_Exploit {
    meta:
        description = "Detects potential symlink exploitation targeting Acronis Cyber Protect"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-28721"
    strings:
        $s1 = "Acronis" nocase
        $s2 = "Cyber Protect" nocase
        $s3 = "mklink" nocase
        $s4 = "SymbolicLink" nocase
    condition:
        (uint16(0) == 0x5A4D) and // PE file
        all of ($s1, $s2) and
        any of ($s3, $s4)
}

Sigma Rule

title: CVE-2026-28721 - Acronis Cyber Protect Symlink Privilege Escalation
id: 8a4b6c2d-1e3f-4a5b-9c7d-8e9f0a1b2c3d
status: experimental
description: Detects creation of symbolic links in Acronis directories or unusual file writes by Acronis processes.
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28721
logsource:
    product: windows
    service: security
detection:
    selection_symlink:
        EventID: 4663
        ObjectName|contains:
            - 'C:\ProgramData\Acronis'
            - 'C:\Windows\Temp'
        AccessMask: '0x2' # WRITE_DAC or WRITE_OWNER
    selection_process:
        EventID: 1
        Image|endswith: '\acronis_agent.exe'
        TargetFilename|endswith:
            - '.exe'
            - '.dll'
            - '.sys'
            - 'hosts'
    condition: selection_symlink or selection_process
falsepositives:
    - Legitimate Acronis updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2026-28721 - Acronis Cyber Protect Potential C2"; flow:to_server,established; content:"Acronis"; nocase; content:"Cyber Protect"; nocase; pcre:"/update|backup/i"; classtype:trojan-activity; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Acronis Cyber Protect 17 to build 41186 or later. This is the only confirmed fix.
2. Workaround: If patching is not possible, restrict the SeCreateSymbolicLinkPrivilege to administrators only via Group Policy:
   • Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Create symbolic links
3. Monitor: Enable auditing for file creation and symlink events in Acronis directories.

Long-term:

• Implement the principle of least privilege for all services.
• Use Windows Defender Application Control (WDAC) to allow only signed binaries.
• Regularly review vendor security advisories.

Valters IT