Acronis DeviceLock DLP CVE-2026-44609

Attacker must already possess a local low-privileged account on the Windows host running Acronis DeviceLock DLP (PR:L), must be able to write the hijacking EXE to a location consulted by DeviceLock's search path (the specific writable path is not disclosed in the available data and should be confirmed against advisory SEC-3084), and exploitation only triggers when a user or admin performs an action that causes DeviceLock to invoke that executable (UI:R). Exploitation is limited to the Windows platform, to DeviceLock DLP builds before 9.0.15051.93227, and is not remotely reachable (AV:L) - meaning network-only attackers, kiosk users without file-write capability, or fully patched hosts are out of scope.

The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 7.3) describes a high-impact local issue that requires both low privileges and user interaction, which materially limits mass exploitation: an attacker must already have a foothold on the host and induce a victim (or an admin running a DeviceLock action) to trigger the hijacked EXE. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit identified at time of analysis, so this is best treated as a meaningful endpoint-hardening fix rather than an emergency. Real-world priority is highest where DeviceLock is deployed on multi-user workstations, terminal servers, or VDI hosts - environments where the UI:R requirement is easily satisfied by routine admin activity. Note that the description labels the bug 'EXE hijacking' while CWE-427 covers search-path issues broadly; the precise hijack primitive (unquoted service path, writable install directory, side-loaded helper) is not disclosed in the available data and should be confirmed via the vendor advisory before tailoring detections.

An attacker with an existing low-privileged Windows account - for example a standard domain user on a shared workstation - plants a malicious executable at a location DeviceLock will search when it next launches a helper binary, then waits for or induces an action (an update check, repair, or admin-triggered DeviceLock operation) that satisfies the UI:R requirement. When the privileged DeviceLock service executes the hijacked EXE, the attacker's payload runs with the service's elevated token, granting full host compromise and disabling the DLP control plane.