| CVE-2021-44198 | ALTO7.8 | DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035 | 29/11/2021 |
| CVE-2021-38088 | ALTO7.8 | Acronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking. | 12/08/2021 |
| CVE-2021-38087 | MEDIO6.1 | Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009. | 12/08/2021 |
| CVE-2021-38086 | ALTO7.8 | Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijacking. | 12/08/2021 |
| CVE-2021-32581 | ALTO8.1 | Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation. | 05/08/2021 |
| CVE-2021-32580 | ALTO7.8 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking. | 05/08/2021 |
| CVE-2021-32579 | ALTO7.8 | Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated attacker (who has a local code execution ability) to tamper with the micro-service API. | 05/08/2021 |
| CVE-2021-32578 | ALTO7.8 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2). | 05/08/2021 |
| CVE-2021-32577 | ALTO7.8 | Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. | 05/08/2021 |
| CVE-2021-32576 | ALTO7.8 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2). | 05/08/2021 |
| CVE-2020-14999 | ALTO7.5 | A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection and access sensitive data. | 30/07/2021 |
| CVE-2020-25736 | ALTO7.8 | Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration. | 15/07/2021 |
| CVE-2020-25593 | MEDIO6.7 | Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions. | 15/07/2021 |
| CVE-2020-15495 | ALTO7.8 | Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration. | 15/07/2021 |
| CVE-2020-15496 | ALTO7.8 | Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions. | 15/07/2021 |
| CVE-2020-9452 | ALTO7.8 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe includes functionality to quarantine files by copying a suspected ransomware file from one directory to another using SYSTEM privileges. Because unprivileged users have write permissions in the quarantine folder, it is possible t | 25/05/2021 |
| CVE-2020-9451 | MEDIO5.5 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe keeps a log in a folder where unprivileged users have write permissions. The logs are generated in a predictable pattern, allowing an unprivileged user to create a hardlink from a (not yet created) log file to anti_ransomware_ser | 25/05/2021 |
| CVE-2020-9450 | ALTO7.8 | An issue was discovered in Acronis True Image 2020 24.5.22510. anti_ransomware_service.exe exposes a REST API that can be used by everyone, even unprivileged users. This API is used to communicate from the GUI to anti_ransomware_service.exe. This can be exploited to add an arbitrary malicious executable to the whitelis | 25/05/2021 |
| CVE-2020-35664 | MEDIO6.1 | An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in the console. | 22/02/2021 |
| CVE-2020-35556 | ALTO7.5 | An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service misconfigures CORS, information disclosure can occur. | 22/02/2021 |