CVE-2026-28712 in Cyber Protect 17
Summary
by MITRE • 03/06/2026
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) before build 41186.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/10/2026
This vulnerability represents a critical local privilege escalation flaw that exploits a DLL hijacking weakness in Acronis Cyber Protect 17 Windows edition prior to build 41186. The issue stems from improper handling of dynamic link library loading mechanisms during the software execution process, creating an opportunity for malicious actors to inject arbitrary code with elevated privileges. The vulnerability manifests when the application attempts to load a required DLL file without specifying a complete path, allowing an attacker to place a malicious DLL in a location that gets searched before the legitimate library.
The technical exploitation involves leveraging the Windows DLL search order mechanism where the system first checks the current working directory before examining the system directories. This creates a window of opportunity for attackers to place a malicious DLL with the same name as a legitimate library that the application expects to load. When the application executes and attempts to load the targeted DLL, it inadvertently loads the attacker-controlled version, enabling privilege escalation from standard user to SYSTEM level access. This flaw directly aligns with CWE-426 Untrusted Search Path vulnerability classification and represents a classic example of insecure library loading practices.
The operational impact of this vulnerability is severe as it allows any local user to escalate their privileges without requiring additional authentication or specialized tools. Once exploited, attackers gain complete control over the affected system, enabling them to install malware, modify system files, access sensitive data, and establish persistent backdoors. The vulnerability affects enterprise environments where Acronis Cyber Protect is deployed, potentially providing attackers with a foothold to compromise entire networks through lateral movement. The attack vector requires only local access to the system, making it particularly dangerous in environments where users may have elevated privileges or where physical access is possible.
Organizations should immediately apply the vendor-provided patch for Acronis Cyber Protect 17 build 41186 or later to remediate this vulnerability. System administrators should also implement additional security measures such as monitoring for suspicious DLL loading activities and configuring Windows to use more secure search order mechanisms. The mitigation strategy should include regular security assessments of installed software to identify similar vulnerabilities and ensure that all applications properly implement secure library loading practices. This vulnerability demonstrates the importance of following secure coding practices and adheres to ATT&CK technique T1068 Privilege Escalation through DLL hijacking, making it a critical concern for cybersecurity professionals implementing defense-in-depth strategies.