CVE-2026-50033: Local privilege escalation due to DLL hijacking vulnerability

Synopsis

A DLL hijacking vulnerability in Acronis DeviceLock DLP for Windows allows a local attacker to escalate privileges on the affected host. The attacker must already have a low-privilege account on the machine and must trick another user into triggering the vulnerable load path, after which the planted DLL runs with elevated privileges. Successful exploitation gives the attacker full read, write, and availability control over the system. A patched-image rebuild at build 9.0.15051.93227 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative credentials to stage the attack.

• Victim interactionRequired

  A legitimate user on the machine must trigger the vulnerable DLL load path, for example by launching the affected application, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental pre-conditions beyond placing the malicious DLL in the search path.

Blast Radius

• Reads sensitive files, stored credentials, and protected data managed by DeviceLock DLP on the host.
• Modifies or deletes system files, configuration, and policy data, including DeviceLock DLP policy enforcements.
• Crashes or disables the DeviceLock DLP service and other host processes, removing data-loss-prevention controls entirely.
• Executes arbitrary code at elevated privilege, enabling persistent backdoors or lateral movement within the host environment.