CVE-2025-7779: Privilege Escalation in Acronis True Image

Successful exploitation of CVE-2025-7779 allows an attacker with local access to the affected system to escalate their privileges. This means a standard user could gain administrative or root access, effectively compromising the entire system. The attacker could then install malware, steal sensitive data, modify system configurations, or perform other malicious actions. The impact is particularly severe because it allows bypassing standard user account controls and gaining full control over the macOS environment. While the vulnerability requires local access, this could be achieved through social engineering, physical access, or by exploiting other vulnerabilities to gain an initial foothold.

1. Reserved2025-07-17
2. Published2025-09-30
3. Modified2026-04-10
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-7779 is to upgrade Acronis True Image to build 42571 or later. If immediate upgrading is not possible due to compatibility issues or system downtime concerns, consider implementing stricter access controls and monitoring for suspicious activity. While a direct workaround for the XPC service configuration issue is not readily available, limiting the permissions granted to the XPC service itself could potentially reduce the attack surface. Regularly review and audit XPC service configurations for any anomalies. After upgrading, confirm the fix by attempting to trigger the privilege escalation exploit – it should fail.