CVE-2026-25852: Acronis DeviceLock DLP DLL Hijacking

CVE-2026-25852 Overview

CVE-2026-25852 is a local privilege escalation vulnerability caused by a DLL hijacking flaw in Acronis DeviceLock DLP for Windows. This vulnerability allows a local attacker with low privileges to escalate their permissions by placing a malicious DLL in a location where the affected application will load it, potentially gaining elevated access to the system.

Critical Impact

Local attackers can exploit improper DLL loading behavior to execute arbitrary code with elevated privileges, compromising the confidentiality, integrity, and availability of the affected system.

Affected Products

• Acronis DeviceLock DLP (Windows) before build 9.0.93212

Discovery Timeline

• April 29, 2026 - CVE CVE-2026-25852 published to NVD
• April 29, 2026 - Last updated in NVD database

Technical Details for CVE-2026-25852

Vulnerability Analysis

This vulnerability is classified under CWE-427 (Uncontrolled Search Path Element), which describes a scenario where an application searches for critical resources such as DLLs in directories that may be under attacker control. In the case of Acronis DeviceLock DLP, the application fails to properly validate or restrict the search path used when loading dynamic-link libraries.

The attack requires local access to the target system and user interaction, which makes exploitation more complex. However, once successfully exploited, the attacker can achieve high impact across confidentiality, integrity, and availability dimensions. The vulnerability exists in builds prior to 9.0.93212 and affects Windows deployments of the DeviceLock DLP solution.

Root Cause

The root cause of CVE-2026-25852 lies in the improper handling of DLL search paths within the Acronis DeviceLock DLP application. When the application attempts to load a required DLL, it follows the Windows DLL search order without adequately securing the search path. This allows an attacker to place a malicious DLL with the expected filename in a directory that is searched before the legitimate system directories.

This type of vulnerability typically occurs when developers rely on default Windows DLL loading behavior without implementing safeguards such as specifying absolute paths, using SetDllDirectory() to remove current directory from the search path, or enabling features like SafeDllSearchMode.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have existing access to the target system. The exploitation scenario typically involves the following:

1. The attacker identifies a writable directory that is included in the DLL search path used by Acronis DeviceLock DLP
2. A malicious DLL is crafted with the same name as a legitimate DLL that the application expects to load
3. The malicious DLL is placed in the writable directory
4. When an authorized user or the system executes the vulnerable application, the malicious DLL is loaded and executed with elevated privileges

The requirement for user interaction (UI:R in the CVSS vector) indicates that the attack may depend on a user launching the application or performing a specific action that triggers the vulnerable DLL loading behavior.

Detection Methods for CVE-2026-25852

Indicators of Compromise

• Unexpected DLL files appearing in application directories or user-writable locations associated with Acronis DeviceLock DLP
• Process execution logs showing DLL loads from non-standard paths
• Suspicious files with names matching legitimate Windows or Acronis DLLs in temporary or user-accessible directories

Detection Strategies

• Monitor file system activity for DLL creation events in directories associated with Acronis DeviceLock DLP installation paths
• Implement application whitelisting to detect unauthorized DLLs being loaded by the DeviceLock DLP process
• Use endpoint detection tools to alert on privilege escalation patterns following DLL loading events
• Review Windows Event Logs for unusual module load events related to the affected application

Monitoring Recommendations

• Enable detailed process auditing on systems running Acronis DeviceLock DLP
• Configure file integrity monitoring for the DeviceLock DLP installation directory
• Implement behavioral analysis to detect anomalous privilege escalation following application execution

How to Mitigate CVE-2026-25852

Immediate Actions Required

• Update Acronis DeviceLock DLP to build 9.0.93212 or later immediately
• Audit systems running affected versions to identify potential compromise indicators
• Review directory permissions to ensure users cannot write to application installation paths
• Consider temporarily restricting access to affected systems until patching is complete

Patch Information

Acronis has released a security update addressing this vulnerability in DeviceLock DLP build 9.0.93212. Organizations should update to this version or later to remediate the DLL hijacking vulnerability. For detailed patch information, refer to the Acronis Security Advisory SEC-7217.

Workarounds

• Restrict write permissions on directories in the DLL search path to prevent unauthorized DLL placement
• Implement application control policies to block execution of unauthorized DLLs
• Use Windows Defender Application Control (WDAC) or similar solutions to enforce code integrity policies
• Monitor and audit file system changes in directories associated with the affected application