Read the docs
TI-2021-19898 Aliases CVE-2021-44204GHSA-v5vh-gq27-ch94

Improper authorization in Acronis Cyber Protect 15

Priority LOW 33CWE-285Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

Local privilege escalation via named pipe due to improper access control checks. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287

Why it matters now

EPSS 0.00197 9th percentileScored 2026-11-07
Fix Fixed Acronis Cyber Protect 15 (Acronis): 28035Acronis Agent (Acronis): 27147+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcronisAcronis Cyber Protect 15before 2803528035Patch availableCNA
AcronisAcronis Agentbefore 2714727147Patch availableCNA
AcronisAcronis Cyber Protect Home Officebefore 3961239612Patch availableCNA
AcronisAcronis True Image 2021before 3928739287Patch availableCNA
  • Acronis Cyber Protect 15 VendorAcronis Affected before 28035 Fixed in 28035 Patch available CNA
  • Acronis Agent VendorAcronis Affected before 27147 Fixed in 27147 Patch available CNA
  • Acronis Cyber Protect Home Office VendorAcronis Affected before 39612 Fixed in 39612 Patch available CNA
  • Acronis True Image 2021 VendorAcronis Affected before 39287 Fixed in 39287 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:acronis:true_image:2021:*:*:*:*:-:*:*2021VulnerableAcronis
cpe:2.3:a:acronis:true_image:2021:update_1:*:*:*:windows:*:*2021 update_1VulnerableAcronis
cpe:2.3:a:acronis:true_image:2021:update_2:*:*:*:windows:*:*2021 update_2VulnerableAcronis
cpe:2.3:a:acronis:true_image:2021:update_3:*:*:*:windows:*:*2021 update_3VulnerableAcronis
cpe:2.3:a:acronis:true_image:2021:update_4:*:*:*:windows:*:*2021 update_4VulnerableAcronis
cpe:2.3:a:acronis:true_image:2021:update_5:*:*:*:windows:*:*2021 update_5VulnerableAcronis
cpe:2.3:a:acronis:agent:*:*:*:*:*:*:*:*before c21.06VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:*15VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:*15 update1VulnerableAcronis
cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:*15 update2VulnerableAcronis
  • cpe:2.3:a:acronis:true_image:2021:*:*:*:*:-:*:* Versions 2021 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:true_image:2021:update_1:*:*:*:windows:*:* Versions 2021 update_1 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:true_image:2021:update_2:*:*:*:windows:*:* Versions 2021 update_2 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:true_image:2021:update_3:*:*:*:windows:*:* Versions 2021 update_3 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:true_image:2021:update_4:*:*:*:windows:*:* Versions 2021 update_4 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:true_image:2021:update_5:*:*:*:windows:*:* Versions 2021 update_5 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:agent:*:*:*:*:*:*:*:* Versions before c21.06 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:* Versions 15 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:* Versions 15 update1 Vulnerable ·Acronis
  • cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:* Versions 15 update2 Vulnerable ·Acronis
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:acronis:cyber_protect_home_office:-:*:*:*:*:*:*:*not specified by NVDVulnerableAcronis
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:acronis:cyber_protect_home_office:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acronis
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Acronis Cyber Protect 15 (Acronis) Fixed in 28035
  • Fix · CNA Acronis Agent (Acronis) Fixed in 27147
  • Fix · CNA Acronis Cyber Protect Home Office (Acronis) Fixed in 39612
  • Fix · CNA Acronis True Image 2021 (Acronis) Fixed in 39287

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Acronis True Image 2021 39287

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2022-08060 Improper signature verification in Acronis Cyber Protect Home OfficePriority LOW 33
    • TI-2022-08058 Incorrect default permissions in Acronis Cyber Protect 15Priority LOW 33
    • TI-2021-19900 Uncontrolled search path in Acronis Cyber Protect Home OfficePriority LOW 32
    Show all 6 records →
  • Release ·

    Acronis Cyber Protect Home Office 39612

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2022-08058 Incorrect default permissions in Acronis Cyber Protect 15Priority LOW 33
    • TI-2021-19900 Uncontrolled search path in Acronis Cyber Protect Home OfficePriority LOW 32
    • TI-2021-19899 Uncontrolled search path in Acronis Cyber Protect Home OfficePriority LOW 32
    Show all 4 records →
Show 1 more group
  • Release ·

    Acronis Agent, Acronis Cyber Protect 15 27147, 28035

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-08058 Incorrect default permissions in Acronis Cyber Protect 15Priority LOW 33
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44204
  2. 2026-10-03 Alias added: GHSA-v5vh-gq27-ch94

References

Advisory 1

  • TI-2022-22414 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
  • TI-2023-22158 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
  • TI-2026-22938 Incorrect default permissions in Acronis Cyber Protect 17 CVSS 3.0HIGH 7.8
  • TI-2023-22159 Improper signature verification in Acronis Agent CVSS 3.1HIGH 7.8
  • TI-2022-22415 Improper privilege management in Acronis Agent CVSS 3.1HIGH 7.8
  • TI-2022-13037 Information disclosure in Acronis Cyber Protect 15 CVSS 3.1HIGH 7.5
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences