CVE-2026-42061: Local privilege escalation due to excessive permissions assigned to child processes

Synopsis

This is a local privilege escalation vulnerability in Acronis DeviceLock DLP for Windows. An attacker with a low-privilege local account can exploit excessively permissive child process configurations to gain elevated system rights, but requires victim interaction to trigger the exploit path. Successful exploitation gives the attacker full read, write, and availability control over affected resources. A patched-image rebuild at version 9.0.15051.93227 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrator or elevated credentials are needed to begin the attack.

• Victim interactionRequired

  A local user must perform some action (such as opening a file or triggering a process) to complete the exploit chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker reads sensitive files and data accessible to elevated processes, including credentials and configuration stores.
• The attacker modifies system files, registry entries, or application data that the escalated process has write access to.
• The attacker disrupts or terminates processes and services running under higher-privilege contexts, causing service outages on the affected host.
• Full compromise of the local Windows host is achievable, as the combination of high confidentiality, integrity, and availability impact leaves no aspect of the system protected.