CVE-2026-44609: Acronis DeviceLock DLP Local Privilege Escalation via EXE Hijacking

Technical summary

CVE-2026-44609 is classified as an EXE hijacking vulnerability (CWE-427) affecting Acronis DeviceLock DLP on Windows. The vulnerability arises from insufficient path validation or DLL/executable search-order logic, allowing a local, unprivileged user to place a crafted executable in a location where DeviceLock will load and execute it with elevated privileges. The CVSS 3.0 score of 7.3 (HIGH severity) reflects local attack vector, low attack complexity, low privileges required, and user interaction, with complete compromise of confidentiality, integrity, and availability. The vulnerability was first published on 2026-06-03 and last modified on 2026-06-17. All versions of Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227 are affected.

Business impact

Organizations relying on Acronis DeviceLock DLP for data loss prevention and endpoint security face elevated risk of privilege escalation on compromised or insider-threat scenarios. A local attacker—such as a malicious insider, remote access user, or threat actor with initial foothold on a system—can escalate to system administrator level, bypassing DLP controls, accessing sensitive data, modifying security configurations, or deploying persistent malware. This directly undermines the protective value of the DLP solution and can lead to unauthorized data exfiltration, compliance violations, and operational disruption.

Affected systems

Acronis DeviceLock DLP (Windows) versions before build 9.0.15051.93227 are vulnerable. This includes all prior releases and builds of DeviceLock DLP on Windows platforms. Organizations should verify their current build version against this threshold. The vulnerability does not affect non-Windows deployments or other Acronis products outside the DeviceLock DLP line unless they share the same vulnerable code path.

Exploitability

Exploitation requires local system access and low-level user privileges, making it practical in environments where users have workstation access—including employee machines, shared terminals, or systems already compromised by lower-privilege malware. The attack requires user interaction (the user must trigger an action that causes DeviceLock to load the hijacked executable), which adds a friction element but is typically straightforward to trigger through social engineering or legitimate workflow manipulation. The attack complexity is low, meaning standard tooling and techniques suffice. No network connectivity or special tools are required. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but this does not indicate absence of active exploitation; it reflects publication recency or limited public disclosure.

Remediation

The primary remediation is to upgrade Acronis DeviceLock DLP (Windows) to build 9.0.15051.93227 or later. This build version incorporates fixes for the EXE hijacking vulnerability. Organizations should prioritize this patch for systems handling sensitive data or deployed in high-risk environments (e.g., finance, healthcare, legal). No vendor-documented workarounds are presently available; patching is the recommended path. After patching, verify the deployment through automated scanning or manual build verification on a sample of endpoints.

Patch guidance

Obtain the latest build of Acronis DeviceLock DLP from Acronis' official distribution channel or your software asset management portal. Pre-patch testing should be conducted in a non-production environment to verify compatibility with existing security policies and user workflows. Deploy patches promptly to production endpoints, prioritizing systems with the highest data sensitivity or user privilege levels. Coordinate deployment windows to avoid disruption to critical business operations. Post-deployment, confirm via agent telemetry or endpoint checks that the patched build is running. Document the patch version and deployment date for compliance and incident response records.

Detection guidance

Monitor for indicators of EXE hijacking attempts: unusual file creation or modification in directories where DeviceLock searches for executables (typically application directories, system paths, or user-writable locations); suspicious executables appearing in unexpected locations with similar names to legitimate DeviceLock binaries; and failed DeviceLock process launches followed by unexpected child processes running with elevated privileges. Endpoint Detection & Response (EDR) tools should flag unauthorized privilege escalation from DeviceLock parent processes. Log analysis should capture any elevation events correlated with DeviceLock activity. Behavioral monitoring for file-write-then-execute sequences in protected directories can help surface exploitation attempts pre-compromise.

Why prioritize this

While the CVSS score is 7.3 (HIGH), prioritization should reflect the specific operational context: (1) DeviceLock DLP systems protect sensitive data; compromise of these systems directly undermines data protection objectives; (2) exploitation is practical for insiders or low-privilege attackers already on the network; (3) the user-interaction requirement, though present, is easily satisfied in typical workflows; (4) no known public exploits or KEV listing does not eliminate active threat; (5) patch availability mitigates risk quickly if deployment processes are efficient. Treat this as a high-priority patch for sensitive environments and a standard-priority patch for general enterprise deployments, depending on data classification and endpoint role.

Risk score, explained

The CVSS 3.0 score of 7.3 (HIGH) is driven by: local attack vector (requires system access but no network path), low attack complexity (standard hijacking techniques), low privilege requirement (user-level sufficient), user interaction mandatory (slightly reduces score but remains exploitable in normal operations), and complete impact on confidentiality, integrity, and availability (attacker gains full system control). The score appropriately reflects the severity for environments where DLP solutions are trust-critical. Contextual risk may be higher in organizations with elevated insider-threat risk or lower in air-gapped, physically restricted environments.

Frequently asked questions