This vulnerability (CVE-2024-34010) involves an unquoted search path issue (CWE-428) in Acronis Cyber Protect Cloud Agent and other Acronis Windows products before certain build versions. An unquoted search path can allow an attacker with local access to execute arbitrary code with elevated privileges by placing malicious executables in directories that are searched by the affected software. The CVSS 3.0 score of 8.2 reflects a high severity local privilege escalation with low attack complexity, requiring high privileges but no user interaction, and impacts confidentiality, integrity, and availability. The affected products include Acronis Cyber Protect Cloud Agent (Windows) before build 37758, Acronis Cyber Protect 16 (Windows) before build 38690, Acronis True Image (Windows) before build 42386, and Acronis True Image OEM (Windows) before build 42575. No vendor advisory or patch information is provided in the input data.

Successful exploitation could allow a local attacker with existing high privileges to escalate their privileges further, potentially gaining full control over the affected system. This could lead to complete compromise of confidentiality, integrity, and availability of the system. The vulnerability does not require user interaction and has low attack complexity but requires local access with high privileges initially.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local access to trusted users only and monitor for suspicious activity related to privilege escalation attempts. Avoid running affected versions on systems where local privilege escalation could lead to significant impact.