This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Acronis Cyber Protect Cloud Agent fixes 2 vulnerabilities
Acronis fixes 2 vulnerabilities in the Acronis Cyber Protect Cloud Agent product. Fixed versions can be found in the links for the individual vulnerabilities [1][2].
Due to incorrectly configured folder permissions, an authenticated local attacker can elevate their privileges [1].
The vulnerability is present in product:
- Acronis Cyber Protect Cloud Agent (Windows); <build 40296
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-9578 at cve.org, NVD
- CWE-732: Incorrect Permission Assignment for Critical Resource at cwe.mitre.org
The vulnerability was publicly disclosed 28. 8. 2025.
Due to improper handling of symbolic links, an authenticated local attacker can elevate their privileges [2].
The vulnerability is present in product:
- Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows); <build 40296
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-48963 at cve.org, NVD
- CWE-610: Externally Controlled Reference to a Resource in Another Sphere at cwe.mitre.org
The vulnerability was publicly disclosed 18. 7. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 2. 9. 2025.