CVE-2026-28722

Executive Summary

CVE-2026-28722 is a local privilege escalation vulnerability in Acronis Cyber Protect 17 (Windows) prior to build 41186. The flaw stems from improper handling of symbolic links (soft links), allowing a low-privileged attacker to elevate their privileges to SYSTEM level. The vulnerability has a CVSS score of 7.3 (High) and is currently unpatched in older builds. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the local attack vector and the potential for full system compromise, this vulnerability poses a significant risk to unpatched systems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.3 (High)
• Attack Vector: Local (AV:L) – Requires local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Attacker can disrupt system operations.

Threat Level: High. While no public exploits exist, the vulnerability is trivial to exploit once the mechanism is understood, and it affects a widely deployed enterprise backup solution.

Deep Dive & Mechanics

The vulnerability resides in how Acronis Cyber Protect 17 handles symbolic links during file operations. The software, when performing privileged actions (e.g., creating, deleting, or modifying files), does not properly validate whether a file path is a symbolic link. An attacker can create a symbolic link pointing from a location they control (e.g., a temporary directory) to a critical system file (e.g., C:\Windows\System32\config\SAM or a driver file). When the Acronis service (running as SYSTEM) performs an operation on the attacker-controlled path, it inadvertently follows the symlink and operates on the target system file, leading to privilege escalation.

Attack Scenario:

1. Attacker gains low-privileged access to a Windows system running Acronis Cyber Protect 17 (build < 41186).
2. Attacker identifies a file operation performed by the Acronis service (e.g., backup, restore, or update) that writes to a user-writable directory.
3. Attacker creates a symbolic link in that directory pointing to a protected system file (e.g., C:\Windows\System32\drivers\etc\hosts or a service binary).
4. When the Acronis service performs the operation, it writes to the symlink target, overwriting the system file.
5. Attacker can then execute arbitrary code with SYSTEM privileges (e.g., by overwriting a service binary or modifying system configuration).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable file operation
void PerformFileOperation(const char* userPath) {
    // No symlink check
    FILE* file = fopen(userPath, "w");
    if (file) {
        fwrite(data, 1, size, file);
        fclose(file);
    }
}

Patched Code (Conceptual):

// Pseudocode for patched file operation
void PerformFileOperation(const char* userPath) {
    // Check if path is a symbolic link
    if (IsSymlink(userPath)) {
        LogError("Symlink detected, aborting operation");
        return;
    }
    // Resolve to real path and verify it's within allowed directories
    char realPath[MAX_PATH];
    GetFinalPathNameByHandle(userPath, realPath, MAX_PATH, VOLUME_NAME_DOS);
    if (!IsPathAllowed(realPath)) {
        LogError("Path not allowed");
        return;
    }
    FILE* file = fopen(realPath, "w");
    if (file) {
        fwrite(data, 1, size, file);
        fclose(file);
    }
}

The patched version adds symlink detection and path validation to prevent following malicious links.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows system with Acronis Cyber Protect 17 (build < 41186) installed.
• Low-privileged user account (e.g., user).

Steps:

1. Identify a writable directory used by Acronis (e.g., C:\ProgramData\Acronis\Temp).
2. Create a symbolic link:

   mklink C:\ProgramData\Acronis\Temp\evil_link.txt C:\Windows\System32\drivers\etc\hosts
   

3. Trigger the vulnerable operation (e.g., start a backup job or update).
4. The Acronis service writes to evil_link.txt, which actually overwrites C:\Windows\System32\drivers\etc\hosts.
5. Modify the hosts file to redirect traffic or execute a payload.

Alternative Target: Overwrite a service binary:

mklink C:\ProgramData\Acronis\Temp\evil_link.dll C:\Windows\System32\sethc.exe

Then trigger the operation and press Shift 5 times at login to execute the payload.

Blue Team (Detection & Prevention)

Detection:

• Monitor for creation of symbolic links by non-admin users in sensitive directories.
• Alert on file writes to system-protected paths (e.g., C:\Windows\System32) by the Acronis service.
• Use Sysmon Event ID 7 (Image loaded) to detect DLL hijacking attempts.

Prevention:

• Apply the patch (build 41186 or later).
• Restrict write permissions to Acronis temporary directories.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block symbolic link creation from untrusted processes.
• Use AppLocker or WDAC to prevent unauthorized binaries from running.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected symbolic links in C:\ProgramData\Acronis\Temp\ or similar directories.
  • Modified system files (e.g., hosts, sethc.exe, utilman.exe).
• Process:
  • Acronis service (acronis_agent.exe or similar) writing to unusual paths.
• Registry:
  • Unauthorized changes to HKLM\SYSTEM\CurrentControlSet\Services (service binary paths).
• Network:
  • Outbound connections from SYSTEM account to attacker-controlled IPs (if payload executed).

Detection Engineering

YARA Rule

rule CVE_2026_28722_Symlink_Exploit {
    meta:
        description = "Detects symbolic link creation targeting system files for CVE-2026-28722"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-28722"
    strings:
        $symlink_cmd = "mklink" nocase
        $system_path = "System32" nocase
        $acronis_path = "ProgramData\\Acronis" nocase
    condition:
        $symlink_cmd and $system_path and $acronis_path
}

Sigma Rule

title: CVE-2026-28722 - Acronis Symlink Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of symbolic links by non-admin users targeting system files in Acronis directories
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28722
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11  # FileCreate
        TargetFilename|contains: 'ProgramData\Acronis'
        TargetFilename|endswith: '.lnk'
    condition: selection
falsepositives:
    - Legitimate Acronis operations (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-28722 - Acronis Symlink Exploit - Potential C2"; flow:to_server,established; content:"|00|"; depth:1; content:"|01|"; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Acronis Cyber Protect 17 to build 41186 or later.
2. Workaround: If patching is not possible, restrict write access to Acronis temporary directories using NTFS permissions.
3. Monitoring: Enable auditing for symbolic link creation (Event ID 11 in Sysmon) and file writes to system directories.
4. Hardening: Apply Windows Defender ASR rules to block symbolic link creation from untrusted processes.
5. Validation: After patching, verify the build number in the Acronis console.

Valters IT
Securing Digital Frontiers