PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25852 Acronis CVE debrief

A local privilege escalation vulnerability exists in Acronis DeviceLock DLP for Windows due to DLL hijacking (CWE-427). The vulnerability affects versions prior to build 9.0.93212. An attacker with local access and low privileges could exploit this issue by placing a malicious DLL in a location that the affected application loads from, resulting in execution with elevated privileges. The CVSS 3.0 vector indicates this requires local access (AV:L), high attack complexity (AC:H), low privileges (PR:L), and user interaction (UI:R), with high impacts to confidentiality, integrity, and availability. The vulnerability was published on April 29, 2026, and last modified on May 19, 2026. Acronis has issued security advisory SEC-7217 addressing this issue.

Vendor
Acronis
Product
Acronis DeviceLock DLP
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-29
Original CVE updated
2026-05-19
Advisory published
2026-04-29
Advisory updated
2026-05-19

Who should care

Organizations running Acronis DeviceLock DLP on Windows endpoints, particularly those with multi-user environments where low-privilege users have write access to application directories or system paths. Security teams responsible for endpoint protection and data loss prevention infrastructure should prioritize patching.

Technical summary

The vulnerability stems from improper handling of DLL search paths (CWE-427), allowing an attacker to place a malicious DLL in a directory that the DeviceLock DLP application searches before the legitimate DLL location. When the application loads, it executes the attacker's code with elevated privileges. The attack requires local access, existing low-level privileges, and user interaction to trigger the vulnerable code path. The high attack complexity reflects the need for precise timing and conditions to successfully hijack the DLL load.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Acronis DeviceLock DLP to build 9.0.93212 or later
  • Review Acronis security advisory SEC-7217 for detailed remediation guidance
  • Implement application whitelisting and DLL loading restrictions as defense-in-depth
  • Monitor for unauthorized DLL placement in application directories
  • Validate DLL signatures and enforce Safe DLL Search Mode on affected systems

Evidence notes

Primary source: Acronis security advisory SEC-7217. CVSS 3.0 vector: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. CWE-427 (Uncontrolled Search Path Element) identified as root cause. Affected product: Acronis DeviceLock DLP (Windows) before build 9.0.93212.

Official resources

Acronis published security advisory SEC-7217 addressing this DLL hijacking vulnerability in DeviceLock DLP. The CVE was initially published on April 29, 2026, with a modification on May 19, 2026. The NVD entry currently shows a status of 'D