Read the docs
TI-2021-19893 Aliases CVE-2021-44199GHSA-r24c-4jp9-g34v

Uncontrolled search path in Acronis Cyber Protect 15

Priority LOW 24CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27305, Acronis Cyber Protect Home Office (Windows) before build 39612

Why it matters now

EPSS 0.00233 14th percentileScored 2026-11-07
Fix Fixed Acronis Cyber Protect 15 (Acronis): 28035Acronis Agent (Acronis): 27305+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcronisAcronis Cyber Protect 15before 2803528035Patch availableCNA
AcronisAcronis Agentbefore 2730527305Patch availableCNA
AcronisAcronis Cyber Protect Home Officebefore 3961239612Patch availableCNA
  • Acronis Cyber Protect 15 VendorAcronis Affected before 28035 Fixed in 28035 Patch available CNA
  • Acronis Agent VendorAcronis Affected before 27305 Fixed in 27305 Patch available CNA
  • Acronis Cyber Protect Home Office VendorAcronis Affected before 39612 Fixed in 39612 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:acronis:agent:-:*:*:*:*:*:*:*not specified by NVDVulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:*:*:*:*:*:*:*:*before 15VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:*15VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:*15 update1VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:*15 update2VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect_home_office:-:*:*:*:*:*:*:*not specified by NVDVulnerableAcronis
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:acronis:agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:*:*:*:*:*:*:*:* Versions before 15 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:* Versions 15 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:* Versions 15 update1 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:* Versions 15 update2 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect_home_office:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acronis
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Acronis Cyber Protect 15 (Acronis) Fixed in 28035
  • Fix · CNA Acronis Agent (Acronis) Fixed in 27305
  • Fix · CNA Acronis Cyber Protect Home Office (Acronis) Fixed in 39612

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Acronis Cyber Protect 15 28035

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2021-19892 Uncontrolled search path in Acronis Cyber Protect 15Priority LOW 34
    • TI-2021-19895 Cross-site scripting in Acronis Cyber Protect 15Priority LOW 28
    • TI-2021-19897 Cross-site scripting in Acronis Cyber Protect 15Priority LOW 25
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44199
  2. 2026-10-03 Alias added: GHSA-r24c-4jp9-g34v

References

Patch 1

  • TI-2022-22414 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
  • TI-2023-22158 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
  • TI-2026-22938 Incorrect default permissions in Acronis Cyber Protect 17 CVSS 3.0HIGH 7.8
  • TI-2023-22159 Improper signature verification in Acronis Agent CVSS 3.1HIGH 7.8
  • TI-2022-22415 Improper privilege management in Acronis Agent CVSS 3.1HIGH 7.8
  • TI-2022-13037 Information disclosure in Acronis Cyber Protect 15 CVSS 3.1HIGH 7.5
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences