CVE-2026-27774

MediumCVSS 6.7/10Last modified Jul 24, 2026

Description

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42902.

Metrics

CVSS 3.0 6.7/10CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Apr 2, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-277758.8Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maCVE-2026-277768.8IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesignCVE-2026-277776.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277787.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting mCVE-2026-277797.5Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL CVE-2026-277810.0Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox CVE-2026-277809.8Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input toCVE-2026-277813.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-277834.3Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.CVE-2026-277847.8The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-CVE-2026-277858.8Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.CVE-2026-277875.1Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be ex
CVE-2026-27774: Medium severity, CVSS 6.7 | Vulnix