EUVD-2026-26233Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account
-
DeliverySend crafted oversized input to agent
-
ExploitTrigger out-of-bounds write memory corruption
-
ExecutionHijack execution in privileged service
-
PersistExecute code as SYSTEM
-
ImpactDisable DLP/backup protections
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have low-privileged local access (PR:L, AV:L) to a Windows host on which the vulnerable Acronis DeviceLock DLP (<9.0.93212) or Cyber Protect Cloud Agent (<42183) is installed and running; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the vulnerability is not remotely reachable and not automatable per CISA SSVC, so it cannot be used for initial access or worm-like spread - it is a post-access escalation primitive. Both products are Windows-only, so non-Windows deployments and hosts without these agents installed are unaffected. |
| Impact | The CVSS 3.0 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack requiring low privileges but no user interaction, yielding total loss of confidentiality, integrity, and availability - consistent with the CISA SSVC 'Technical Impact: total' rating. However, exploitation signals are weak: EPSS is 0.01% (3rd percentile), SSVC Exploitation is 'none' with Automatable 'no', and there is no KEV listing or public POC. This is a genuine but non-urgent local EoP: the impact is severe (SYSTEM compromise) yet real-world exploitation probability is low because it requires prior local access and is not automatable. It should be prioritized as routine patching for endpoints running these agents rather than as an emergency, but note that on security-sensitive endpoints a DLP/backup agent compromise undermines the very control it provides. All signals here are internally consistent - no conflict between the local CVSS vector and the 'local privilege escalation' description. |
| Exploit ScenarioDerived | An attacker who already holds an unprivileged local account on a Windows endpoint running the DeviceLock or Cyber Protect Cloud agent sends crafted, oversized input to the privileged agent component, triggering an out-of-bounds write that corrupts memory and hijacks execution to run code as SYSTEM. Because the SSVC technical impact is 'total', this yields full host control and would let the attacker disable the DLP/backup protections themselves. No public exploit is identified at time of analysis, and the low complexity (AC:L) means a working exploit would be reliable once developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
RemediationAI
Vendor-released patch: upgrade Acronis DeviceLock DLP (Windows) to build 9.0.93212 or later, and Acronis Cyber Protect Cloud Agent (Windows) to build 42183 or later, per the vendor advisory at https://security-advisory.acronis.com/advisories/SEC-10296. Because exploitation requires local low-privileged access, effective compensating controls until patching include restricting interactive and remote local logon to these endpoints to trusted administrators, enforcing least privilege so untrusted users cannot run code on hosts carrying the agents, and monitoring for anomalous child processes or crashes of the DeviceLock/Cyber Protect service (a common side effect of memory-corruption exploitation attempts); note these controls reduce but do not eliminate risk for shared or multi-user machines. Additional context is available at https://vuldb.com/vuln/360162.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is Acronis endpoint security tooling running on Windows: DeviceLock DLP, a data-loss-prevention agent that controls device/port access, and the Cyber Protect Cloud Agent, a managed backup/security agent. Both run privileged Windows services or drivers on the endpoint. The root cause is classified as CWE-787 (Out-of-bounds Write): the software fails to validate the size or bounds of attacker-supplied input before writing it into a memory buffer, corrupting adjacent memory. The supplemental tags (Buffer Overflow, Memory Corruption, Privilege Escalation) reinforce that the improper input validation manifests as a memory-corruption primitive within a component that operates at higher privilege than the calling user, enabling an integrity/control violation of the host.
Know when Acronis Devicelock Dlp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation needs a low-privileged local account (AV:L/PR:L), no user interaction (UI:N), and yields total SYSTEM-level compromise (C:H/I:H/A:H) with no scope change.
Primary rating from Vendor (Acronis).
CVSS VectorVendor: Acronis
Lifecycle Timeline
3DescriptionCVE.org
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
Executive ViewAI
Acronis DeviceLock DLP and Cyber Protect Cloud Agent for Windows contain a local privilege escalation vulnerability that allows authenticated users to gain SYSTEM-level control of affected hosts. Organizations running vulnerable versions face complete endpoint compromise and potential exposure of DLP-protected data and compliance violations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Acronis Devicelock Dlp
View allLocal privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud
Local privilege escalation in Acronis DeviceLock DLP on Windows (all builds before 9.0.93212) is achievable via DLL hija
GitHub PoC
Exploit-DB