CVE-2026-44682: Local privilege escalation due to DLL hijacking vulnerability

Synopsis

A DLL hijacking vulnerability in Acronis DeviceLock DLP for Windows allows a local attacker to escalate privileges on the affected host. The attacker needs an existing account on the system and must convince another user to trigger the vulnerable code path; no network access is required. Successful exploitation gives the attacker full control over the host, including the ability to read sensitive data, modify files, and crash or disrupt running services. A patched-image rebuild at version 9.0.15051.93227 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation.

• Victim interactionRequired

  A local user must be socially engineered or otherwise induced to trigger the vulnerable DLL load path.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker controls the DLL search path; no race conditions or special environmental factors are required.

Blast Radius

• A successful attacker reads protected files and sensitive data stored on the host, including credentials and policy configurations managed by DeviceLock DLP.
• The attacker can modify or overwrite persisted files, registry entries, and security policy data on the compromised system.
• The attacker gains the ability to crash or disable running services, including the DeviceLock DLP agent itself.
• Privilege escalation to a higher-privileged context (such as SYSTEM) gives full administrative control over the affected Windows host.