What’s Vulnerable › Vulnerabilities

CVE-2022-24113: Local privilege escalation due to excessive permissions assigned to child processes

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-04 · updated 2026-06-17
• Weakness: CWE-250

Description

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287

Affected products

• Acronis Cyber Protect Cloud Agent: before c21.06 — fixed in c21.06
• Acronis Cyber Protect 15: 15, 15-update1, 15-update2
• Acronis Cyber Protect Home Office: all versions
• Acronis True Image: 2021, 2021-update_1, 2021-update_2, 2021-update_3, 2021-update_4, 2021-update_5

How to fix

Upgrade to a fixed version: Acronis Cyber Protect Cloud Agent c21.06. Check the vendor advisory for mitigations.

References

• https://security-advisory.acronis.com/advisories/SEC-2881
• https://security-advisory.acronis.com/advisories/SEC-2881

Get alerted when CVE-2022-24113 or the next vulnerability affects your stack