EUVD-2026-34173
GHSA-jgh4-c962-w9qg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-priv user session
-
DeliveryTrigger DeviceLock agent to spawn child process
-
ExploitAbuse inherited excessive privileges in child
-
ExecutionExecute code at elevated integrity
-
ImpactTamper with DLP policy and persist
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Attacker must already have an authenticated low-privilege local session on a Windows host running Acronis DeviceLock DLP at a build earlier than 9.0.15051.93227, and must induce user interaction that causes the DeviceLock agent to spawn the affected child process in the user's context (CVSS UI:R). Limiting factors: the attack vector is strictly local (AV:L), so no network-reachable exposure exists; non-Windows DeviceLock builds are out of scope; and hosts already updated to 9.0.15051.93227 or later are not vulnerable. |
| Impact | The CVSS 3.0 vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H describes a local, low-complexity attack requiring low privileges and user interaction, with high impact on all three security properties - consistent with a classic endpoint privilege-escalation primitive rather than a remotely reachable bug. No EPSS score, KEV listing, or public POC has been provided, so real-world exploitation pressure appears low at this time, but DLP agents are high-value targets on managed endpoints because compromise effectively defeats the data-protection control itself. The UI:R requirement and need for an existing local foothold meaningfully limit opportunistic mass exploitation, so this is best treated as a credible post-compromise escalation path on managed Windows fleets rather than an internet-exposed emergency. Note: no EPSS data was supplied in the input, so probabilistic exploitation likelihood cannot be cited. |
| Exploit ScenarioDerived | An attacker who already has a standard user session on a Windows endpoint running a vulnerable DeviceLock DLP build induces the agent to spawn a child process - for example by interacting with a monitored device, policy prompt, or helper UI that requires user action (UI:R) - and abuses the over-privileged inherited token or handle in that child to execute code in a higher-integrity context. The end state is full local compromise of the endpoint, including the ability to disable or tamper with the DLP control itself. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 03, 2026
Local privilege escalation in Acronis DeviceLock DLP for Windows before build 9.0.15051.93227 allows a low-privileged authenticated user to gain elevated privileges by abusing excessive permissions inherited by child processes spawned by the agent. With CVSS 7.3 and a high impact across confidentiality, integrity, and availability, successful exploitation requires user interaction and local access, and no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Acronis DeviceLock DLP for Windows to build 9.0.15051.93227 or later, distributing the update via your standard DeviceLock management console as described in the Acronis advisory at https://security-advisory.acronis.com/advisories/SEC-3083. No vendor-published workaround is referenced; if patching must be deferred, compensating controls include restricting interactive logon and software-execution rights on endpoints where DeviceLock is deployed (via AppLocker or WDAC allowlisting) to reduce the population of local users who can trigger the vulnerable child-process flow, and increasing EDR sensitivity to unexpected child processes of DeviceLock service binaries - both add management overhead and may generate false positives against legitimate admin tooling. Avoid stopping or unloading the DeviceLock agent as a mitigation, since doing so disables the DLP control the product is deployed to enforce.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DeviceLock DLP is an endpoint data loss prevention agent that runs with elevated privileges on Windows hosts to enforce device and channel control policies. The root cause maps to CWE-250 (Execution with Unnecessary Privileges): the protected agent process spawns child processes without dropping or restricting its inherited security token, so a child inherits a privilege set far broader than its function requires. On Windows, this typically manifests as inherited SYSTEM-level or high-integrity tokens, handles, or impersonation rights that an attacker can leverage to break out of the intended sandbox boundary and execute code in the parent's security context. The CPE scope per the vendor advisory is limited to the Windows build of DeviceLock DLP prior to 9.0.15051.93227.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (acronis) · only source for this CVE.
CVSS VectorVendor: acronis
Lifecycle Timeline
2DescriptionCVE.org
Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
Executive ViewAI
Acronis DeviceLock DLP for Windows before build 9.0.15051.93227 contains a local privilege escalation vulnerability that allows authenticated local users to gain elevated privileges and circumvent data protection controls. With CVSS 7.3 severity impacting confidentiality, integrity, and availability, successful exploitation would expose sensitive organizational data and compromise the integrity of DLP enforcement across the organization. Immediate containment and monitoring actions are essential to prevent data breach and insider threats.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations: restrict local administrative access on all affected systems; implement EDR or endpoint monitoring to detect privilege escalation attempts; enforce multi-factor authentication for sensitive systems and accounts; enable comprehensive audit logging of all privileged and authenticated activities; implement network segmentation to contain potential lateral movement; maintain incident response readiness with DeviceLock compromise scenarios.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB