PT-2021-21945 · Acronis · Acronis Cyber Protect 15+2

Published 2021-08-10 · Updated 2021-09-23 · CVE-2021-38086

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 for Windows versions prior to build 27009 Acronis Agent for Windows versions prior to build 26226

Description: The issue allows local privilege escalation via DLL hijacking. This means an attacker could potentially exploit the vulnerability to gain higher privileges on a system, potentially leading to unauthorized access or control.

Recommendations: For Acronis Cyber Protect 15 for Windows versions prior to build 27009, update to build 27009 or later to resolve the issue. For Acronis Agent for Windows versions prior to build 26226, update to build 26226 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive system resources to minimize the risk of exploitation.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2021-38086

Affected Products

Acronis

Acronis Agent

Acronis Cyber Protect 15

References · 7

• https://kb.acronis.com/content/68564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38086 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38086 · Vendor Advisory
• https://t.me/cvenotify/19211 · Telegram Post
• https://t.me/cvenotify/21340 · Telegram Post
• https://security-advisory.acronis.com/advisories/SEC-2279 · Note
• https://t.me/cibsecurity/27230 · Telegram Post