EUVD-2026-26229Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Local DLL hijacking requires an existing low-privileged account (PR:L), specific search-path conditions (AC:H), a triggering user action (UI:R), and no scope change; full system control if successful justifies C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212.
AnalysisAI
Local privilege escalation in Acronis DeviceLock DLP on Windows (all builds before 9.0.93212) is achievable via DLL hijacking, granting an attacker full confidentiality, integrity, and availability impact over the affected system. Exploitation requires a low-privileged local account, high attack complexity, and user interaction - all factors that meaningfully constrain real-world exploitability despite the severe potential impact. No public exploit code and no active exploitation have been identified at time of analysis; EPSS at 0.01% (3rd percentile) and SSVC Exploitation status of 'none' both confirm negligible mass-exploitation probability.
Technical ContextAI
CWE-427 (Uncontrolled Search Path Element) describes the root cause: the Acronis DeviceLock DLP agent on Windows loads one or more DLLs by name without specifying an absolute path, causing Windows to resolve the library via its default DLL search order (application directory, system32, PATH entries, etc.). If an attacker can place a malicious DLL with the expected name in a directory that appears earlier in the search order than the legitimate library location - particularly a user-writable directory - the application will load the attacker's code instead. Because DeviceLock DLP is a security enforcement product that typically runs with elevated privileges, the hijacked DLL executes in a privileged context. The affected product is identified by CPE cpe:2.3:a:acronis:acronis_devicelock_dlp:*:*:*:*:*:*:*:* covering all Windows builds prior to 9.0.93212.
RemediationAI
Upgrade Acronis DeviceLock DLP to build 9.0.93212 or later; this is the vendor-released patch confirmed by Acronis advisory SEC-7217 (https://security-advisory.acronis.com/advisories/SEC-7217). As a compensating control prior to patching, audit and restrict write permissions on directories present in the DLL search path used by DeviceLock DLP processes - specifically the application's working directory and any user-writable entries in the system PATH. Removing user write access from these directories prevents DLL planting; note that overly broad path restrictions may interfere with legitimate application behavior and should be tested in a non-production environment first. Enforcing least-privilege access controls to limit which accounts can write to application directories reduces the attack surface further.
More in Acronis Devicelock Dlp
View allLocal privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Clou
Local privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today