Acronis DeviceLock DLP CVE-2026-25852

The attacker must hold a local, low-privileged Windows account on the target system (PR:L) and must be able to write a file to a directory within the DLL search path used by the Acronis DeviceLock DLP process. High attack complexity (AC:H) means that additional conditions beyond the attacker's direct control must be met - such as the absence of the legitimate DLL in a higher-priority search path directory, a specific process startup sequence, or a timing dependency. User interaction (UI:R) is required: a privileged user or system event must trigger the DLP agent to perform the vulnerable DLL load. The attack is not automatable (SSVC) and is entirely local (AV:L), making remote or unauthenticated exploitation impossible. Defenders: environments where endpoint users cannot write to application or PATH directories, or where AppLocker/WDAC policies restrict DLL loading, are largely protected even without patching.

The CVSS 3.0 base score of 6.7 (Medium) is internally consistent: AV:L restricts the attack to the local machine, AC:H signals that specific conditions beyond the attacker's control must be met (e.g., a race condition or particular search-path state), PR:L requires an existing low-privileged account, and UI:R demands a triggering action by another user or process. The C:H/I:H/A:H impact triad reflects full system compromise if the attack succeeds. EPSS of 0.01% (3rd percentile) aligns tightly with these low-exploitability metrics, indicating automated or opportunistic mass exploitation is implausible. SSVC classification reinforces this: Exploitation is 'none' (no in-the-wild activity observed), Automatable is 'no' (prerequisites prevent scripted mass targeting), and Technical Impact is 'total' (consistent with the CVSS C/I/A ratings). There is no CISA KEV listing and no public exploit code. Taken together, this is a real but lower-urgency vulnerability - it matters in environments where DeviceLock DLP is deployed and where adversaries may already have local access, but it does not represent a priority for most organizations.

A local low-privileged user on a Windows endpoint running a vulnerable DeviceLock DLP build writes a crafted DLL with the name expected by the DLP agent into a user-writable directory that appears earlier in the Windows DLL search order than the legitimate library. When a privileged process or user action causes the DLP agent to load the DLL - the required user interaction - the malicious library executes in the agent's elevated context, granting the attacker full control of the system. No public exploit code is known at time of analysis; the High attack complexity (AC:H) indicates that specific environmental conditions or timing must align for successful exploitation.