EUVD-2026-26233Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation needs a low-privileged local account (AV:L/PR:L), no user interaction (UI:N), and yields total SYSTEM-level compromise (C:H/I:H/A:H) with no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.93212, Acronis Cyber Protect Cloud Agent (Windows) before build 42183.
AnalysisAI
Local privilege escalation in Acronis DeviceLock DLP for Windows (before build 9.0.93212) and Acronis Cyber Protect Cloud Agent for Windows (before build 42183) allows an authenticated low-privileged user to write outside allocated memory bounds and gain full SYSTEM-level control of the host. The flaw stems from improper input validation leading to memory corruption (CWE-787 out-of-bounds write). There is no public exploit identified at time of analysis, and the EPSS score is very low (0.01%, 3rd percentile), consistent with the CISA SSVC assessment of exploitation status 'none'.
Technical ContextAI
The affected software is Acronis endpoint security tooling running on Windows: DeviceLock DLP, a data-loss-prevention agent that controls device/port access, and the Cyber Protect Cloud Agent, a managed backup/security agent. Both run privileged Windows services or drivers on the endpoint. The root cause is classified as CWE-787 (Out-of-bounds Write): the software fails to validate the size or bounds of attacker-supplied input before writing it into a memory buffer, corrupting adjacent memory. The supplemental tags (Buffer Overflow, Memory Corruption, Privilege Escalation) reinforce that the improper input validation manifests as a memory-corruption primitive within a component that operates at higher privilege than the calling user, enabling an integrity/control violation of the host.
RemediationAI
Vendor-released patch: upgrade Acronis DeviceLock DLP (Windows) to build 9.0.93212 or later, and Acronis Cyber Protect Cloud Agent (Windows) to build 42183 or later, per the vendor advisory at https://security-advisory.acronis.com/advisories/SEC-10296. Because exploitation requires local low-privileged access, effective compensating controls until patching include restricting interactive and remote local logon to these endpoints to trusted administrators, enforcing least privilege so untrusted users cannot run code on hosts carrying the agents, and monitoring for anomalous child processes or crashes of the DeviceLock/Cyber Protect service (a common side effect of memory-corruption exploitation attempts); note these controls reduce but do not eliminate risk for shared or multi-user machines. Additional context is available at https://vuldb.com/vuln/360162.
More in Acronis Devicelock Dlp
View allLocal privilege escalation in Acronis DeviceLock DLP (Windows, builds before 9.0.93212) and Acronis Cyber Protect Cloud
Local privilege escalation in Acronis DeviceLock DLP on Windows (all builds before 9.0.93212) is achievable via DLL hija
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today