Lokaal privilege escalation door onveilige XPC service configuratie. De volgende producten zijn getroffen: Acronis True Image (macOS) vóór build 42389, Acronis True Image for SanDisk (macOS) vóór

Successful exploitation of CVE-2025-7779 allows an attacker with local access to the affected system to escalate their privileges. This means a standard user could gain administrative or root access, effectively compromising the entire system. The attacker could then install malware, steal sensitive data, modify system configurations, or perform other malicious actions. The impact is particularly severe because it allows bypassing standard user account controls and gaining full control over the macOS environment. While the vulnerability requires local access, this could be achieved through social engineering, physical access, or by exploiting other vulnerabilities to gain an initial foothold.

Users of Acronis True Image for macOS, particularly those running legacy versions prior to build 42571, are at risk. This includes individuals and organizations relying on Acronis for backup and recovery solutions. Shared hosting environments where multiple users share the same macOS system are also at increased risk, as a compromised user account could potentially be leveraged to escalate privileges.

• macos: Use lsyslog to monitor for XPC service errors related to authentication or authorization.

lsof -i :xpc | grep Acronis

• macos: Check system logs for unusual process executions with elevated privileges.

log show --last 1h | grep -i 'Acronis' | grep -i 'privilege escalation'

• macos: Monitor for unexpected changes to system configuration files, particularly those related to user accounts and permissions.

find / -name '*acronis*' -mtime -1

1. 2025-09-30Disclosure

   disclosure

1. Gereserveerd2025-07-17
2. Gepubliceerd2025-09-30
3. Gewijzigd2026-04-10
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-7779 is to upgrade Acronis True Image to build 42571 or later. If immediate upgrading is not possible due to compatibility issues or system downtime concerns, consider implementing stricter access controls and monitoring for suspicious activity. While a direct workaround for the XPC service configuration issue is not readily available, limiting the permissions granted to the XPC service itself could potentially reduce the attack surface. Regularly review and audit XPC service configurations for any anomalies. After upgrading, confirm the fix by attempting to trigger the privilege escalation exploit – it should fail.