Local privilege escalation due to incomplete uninstallation cleanup.
Priority LOW 33CWE-459Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107, Acronis Agent (Windows) before build 30025, Acronis Cyber Protect 15 (Windows) before build 30984.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00149 4th percentileScored 2026-11-07
Fix Fixed Acronis Cyber Protect Home Office (Acronis): 40107Acronis Agent (Acronis): 30025+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Acronis | Acronis Cyber Protect Home Office | before 40107 | 40107 | Patch available | CNA |
| Acronis | Acronis Agent | before 30025 | 30025 | Patch available | CNA |
| Acronis | Acronis Cyber Protect 15 | before 30984 | 30984 | Patch available | CNA |
- Acronis Cyber Protect Home Office VendorAcronis Affected before 40107 Fixed in 40107 Patch available CNA
- Acronis Agent VendorAcronis Affected before 30025 Fixed in 30025 Patch available CNA
- Acronis Cyber Protect 15 VendorAcronis Affected before 30984 Fixed in 30984 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:acronis:agent:*:*:*:*:*:*:*:* | before c22.07 | Vulnerable | Acronis |
| cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:* | 15 | Vulnerable | Acronis |
| cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:* | 15 update1 | Vulnerable | Acronis |
| cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:* | 15 update2 | Vulnerable | Acronis |
| cpe:2.3:a:acronis:cyber_protect:15:update3:*:*:*:*:*:* | 15 update3 | Vulnerable | Acronis |
| cpe:2.3:a:acronis:cyber_protect:15:update4:*:*:*:*:*:* | 15 update4 | Vulnerable | Acronis |
| cpe:2.3:a:acronis:cyber_protect_home_office:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Acronis |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:acronis:agent:*:*:*:*:*:*:*:* Versions before c22.07 Vulnerable ·Acronis
- cpe:2.3:a:acronis:cyber_protect:15:-:*:*:*:*:*:* Versions 15 Vulnerable ·Acronis
- cpe:2.3:a:acronis:cyber_protect:15:update1:*:*:*:*:*:* Versions 15 update1 Vulnerable ·Acronis
- cpe:2.3:a:acronis:cyber_protect:15:update2:*:*:*:*:*:* Versions 15 update2 Vulnerable ·Acronis
- cpe:2.3:a:acronis:cyber_protect:15:update3:*:*:*:*:*:* Versions 15 update3 Vulnerable ·Acronis
- cpe:2.3:a:acronis:cyber_protect:15:update4:*:*:*:*:*:* Versions 15 update4 Vulnerable ·Acronis
- cpe:2.3:a:acronis:cyber_protect_home_office:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Acronis
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Acronis Cyber Protect Home Office (Acronis) Fixed in 40107
- Fix · CNA Acronis Agent (Acronis) Fixed in 30025
- Fix · CNA Acronis Cyber Protect 15 (Acronis) Fixed in 30984
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Acronis Cyber Protect 15 30984
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2022-22417 Information disclosure in Acronis AgentPriority LOW 32
Timeline
- 2026-10-02 Threatist record created from CVE-2022-45455
- 2026-10-03 Alias added: GHSA-4pgg-95h7-rqc6
References
Advisory 1
More Acronis Agent vulnerabilities
- TI-2022-22414 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
- TI-2023-22158 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
- TI-2026-22938 Incorrect default permissions in Acronis Cyber Protect 17 CVSS 3.0HIGH 7.8
- TI-2023-22159 Improper signature verification in Acronis Agent CVSS 3.1HIGH 7.8
- TI-2022-22415 Improper privilege management in Acronis Agent CVSS 3.1HIGH 7.8
- TI-2022-13037 Information disclosure in Acronis Cyber Protect 15 CVSS 3.1HIGH 7.5
Sources
- CVE-2022-45455 · CVE Program
- CVE-2022-45455 · NVD
- FIRST EPSS
- GHSA-4pgg-95h7-rqc6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences