Read the docs
TI-2023-26519 Aliases CVE-2023-48677GHSA-qgrp-jmm8-2jmf

Uncontrolled search path in Acronis Cyber Protect Home Office

Priority LOW 34CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901, Acronis Cyber Protect Cloud Agent (Windows) before build 39378, Acronis Cyber Protect 16 (Windows) before build 39938, Acronis True Image OEM (Windows) before build 42575.

Why it matters now

EPSS 0.00248 16th percentileScored 2026-11-07
Fix Fixed Acronis Cyber Protect Home Office (Acronis): 40901Acronis Cyber Protect Cloud Agent (Acronis): 39378+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AcronisAcronis Cyber Protect Home Officebefore 4090140901Patch availableCNA
AcronisAcronis Cyber Protect Cloud Agentbefore 3937839378Patch availableCNA
AcronisAcronis Cyber Protect 16before 3993839938Patch availableCNA
AcronisAcronis True Image OEMbefore 4257542575Patch availableCNA
  • Acronis Cyber Protect Home Office VendorAcronis Affected before 40901 Fixed in 40901 Patch available CNA
  • Acronis Cyber Protect Cloud Agent VendorAcronis Affected before 39378 Fixed in 39378 Patch available CNA
  • Acronis Cyber Protect 16 VendorAcronis Affected before 39938 Fixed in 39938 Patch available CNA
  • Acronis True Image OEM VendorAcronis Affected before 42575 Fixed in 42575 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:acronis:cyber_protect_home_office:*:*:*:*:*:*:*:*before 40901VulnerableAcronis
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:acronis:cyber_protect_home_office:*:*:*:*:*:*:*:* Versions before 40901 Vulnerable ·Acronis
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Acronis Cyber Protect Home Office (Acronis) Fixed in 40901
  • Fix · CNA Acronis Cyber Protect Cloud Agent (Acronis) Fixed in 39378
  • Fix · CNA Acronis Cyber Protect 16 (Acronis) Fixed in 39938
  • Fix · CNA Acronis True Image OEM (Acronis) Fixed in 42575

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48677
  2. 2026-10-03 Alias added: GHSA-qgrp-jmm8-2jmf

References

Advisory 1

  • TI-2023-23740 Missing authorization in Acronis Cyber Protect Home Office CVSS 3.1CRITICAL 9.1
  • TI-2022-22414 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
  • TI-2023-22158 Improper privilege management in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
  • TI-2022-23213 Link following in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
  • TI-2022-23212 Local privilege escalation during recovery due to improper soft link handling. CVSS 3.1HIGH 7.8
  • TI-2022-22036 Link following in Acronis Cyber Protect Home Office CVSS 3.1HIGH 7.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences