This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Acronis True Image fixes 3 vulnerabilities
Acronis fixes 3 vulnerabilities in Acronis True Image. The fixed versions can be found in the links next to the individual vulnerabilities [1][2][3].
Allows an authenticated local attacker to escalate their privileges due to insecure folder permissions in Acronis True Image for Windows [1].
The vulnerability is present in product:
- Acronis True Image (Windows); <build 42902
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-33271 at cve.org, NVD
- CWE-732: Incorrect Permission Assignment for Critical Resource at cwe.mitre.org
The vulnerability was publicly disclosed 1. 4. 2026.
Allows an authenticated local attacker to escalate their privileges due to a DLL hijacking vulnerability in Acronis True Image for Windows [2][3].
The vulnerability is present in product:
- Acronis True Image (Windows); <build 42902
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-28728 at cve.org, NVD
- CVE-2026-27774 at cve.org, NVD
- CWE-427: Uncontrolled Search Path Element at cwe.mitre.org
The vulnerability was publicly disclosed 1. 4. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 2. 4. 2026.