PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25852 Acronis CVE debrief

A local privilege escalation vulnerability exists in Acronis DeviceLock DLP for Windows due to DLL hijacking (CWE-427). The vulnerability affects versions prior to build 9.0.93212. An attacker with local access and low privileges could exploit this issue by placing a malicious DLL in a location that the affected application loads from, resulting in execution with elevated privileges. The CVSS 3.0 vector indicates this requires local access (AV:L), high attack complexity (AC:H), low privileges (PR:L), and user interaction (UI:R), with high impacts to confidentiality, integrity, and availability. The vulnerability was published on April 29, 2026, and last modified on May 19, 2026. Acronis has issued security advisory SEC-7217 addressing this issue.

Vendor
Acronis
Product
Acronis DeviceLock DLP
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-29
Original CVE updated
2026-05-19
Advisory published
2026-04-29
Advisory updated
2026-05-19

Who should care

Organizations running Acronis DeviceLock DLP on Windows endpoints, particularly those with multi-user environments where low-privilege users have write access to application directories or system paths. Security teams responsible for endpoint protection and data loss prevention infrastructure should prioritize patching.

Technical summary

The vulnerability stems from improper handling of DLL search paths (CWE-427), allowing an attacker to place a malicious DLL in a directory that the DeviceLock DLP application searches before the legitimate DLL location. When the application loads, it executes the attacker's code with elevated privileges. The attack requires local access, existing low-level privileges, and user interaction to trigger the vulnerable code path. The high attack complexity reflects the need for precise timing and conditions to successfully hijack the DLL load.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Acronis DeviceLock DLP to build 9.0.93212 or later
  • Review Acronis security advisory SEC-7217 for detailed remediation guidance
  • Implement application whitelisting and DLL loading restrictions as defense-in-depth
  • Monitor for unauthorized DLL placement in application directories
  • Validate DLL signatures and enforce Safe DLL Search Mode on affected systems

Evidence notes

Primary source: Acronis security advisory SEC-7217. CVSS 3.0 vector: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H. CWE-427 (Uncontrolled Search Path Element) identified as root cause. Affected product: Acronis DeviceLock DLP (Windows) before build 9.0.93212.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-25852 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-25852

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-25852 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25852

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.