Acronis DeviceLock DLP CVE-2026-50033

Attacker must already have local, interactive, low-privileged code execution on the Windows host running an unpatched DeviceLock DLP build (any build before 9.0.15051.93227); must be able to write a DLL file to a directory that appears earlier in the DeviceLock process DLL search order than the legitimate library location (a writable application subdirectory or an unsecured %PATH% entry); and a user action is required (UI:R) to launch or trigger the vulnerable DeviceLock component so it loads the planted DLL. Exploitation is constrained to local attack (AV:L) with no remote/network path, does not work against patched build 9.0.15051.93227 or later, and is not possible if the search-order directories are not writable by the attacker's account.

The CVSS 3.0 score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) describes a local, low-complexity attack requiring an authenticated low-privileged user plus user interaction, yielding full confidentiality, integrity, and availability impact within the same scope - consistent with classic DLL hijacking against a privileged Windows service or helper. No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied in the input, so probability of exploitation cannot be quantitatively benchmarked; the absence of KEV and POC data suggests this is not currently observed in mass exploitation, but DLP/endpoint-security agents are attractive post-compromise targets for adversaries who want to disable controls or pivot to SYSTEM. The UI:R requirement (a user must perform some action, e.g. launching an application that triggers the vulnerable load) is the main natural brake on exploitation; insiders and malware already running as a standard user can satisfy this trivially.

A standard-user attacker - for example, a malicious insider or commodity malware running without admin rights - places a malicious DLL with a name the DeviceLock process is known to load by unqualified name into a directory that precedes the legitimate location in the Windows search order. The user (or a scheduled/triggered action) then launches or interacts with the affected DeviceLock component, which loads the planted DLL and runs the attacker's code under the elevated DeviceLock context, giving the attacker the ability to disable DLP enforcement and exfiltrate data.