CVE-2026-42061 Overview
CVE-2026-42061 is a local privilege escalation vulnerability in Acronis DeviceLock DLP for Windows. The flaw stems from excessive permissions assigned to child processes spawned by the affected software. An authenticated local attacker can leverage these inherited privileges to execute code in a higher-privileged security context. The vulnerability is tracked under CWE-250: Execution with Unnecessary Privileges. Acronis addressed the issue in DeviceLock DLP build 9.0.15051.93227 and later. The vendor disclosed the issue in Acronis Security Advisory SEC-3083.
Critical Impact
A local user with low privileges can escalate to a higher-privileged context on systems running vulnerable Acronis DeviceLock DLP builds, compromising confidentiality, integrity, and availability of the host.
Affected Products
- Acronis DeviceLock DLP for Windows builds prior to 9.0.15051.93227
- Windows endpoints running the DeviceLock DLP agent
- Environments using DeviceLock DLP for endpoint data loss prevention
Discovery Timeline
- 2026-06-03 - CVE-2026-42061 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-42061
Vulnerability Analysis
The vulnerability resides in how Acronis DeviceLock DLP launches child processes on Windows hosts. The parent process passes privileged process tokens or excessive access rights down to spawned child processes. This violates the principle of least privilege defined under CWE-250. A local attacker with the ability to interact with these child processes can execute operations using the inherited elevated permissions. Exploitation requires local access, low privileges, and user interaction, but yields high impact across confidentiality, integrity, and availability.
Root Cause
The root cause is an over-privileged process inheritance model. DeviceLock DLP creates child processes without restricting the security context, token privileges, or access rights to the minimum required for the operation. When a low-privileged user influences or interacts with such a child process, they gain access to capabilities the parent process holds, including operations against protected system resources.
Attack Vector
An authenticated local user on a Windows host running a vulnerable DeviceLock DLP build triggers a workflow that spawns a privileged child process. The attacker manipulates the child process or its execution environment to perform actions in the elevated context. Possible techniques include hijacking process input, abusing inherited handles, or directing the child process to perform file or registry operations on attacker-controlled paths. Successful exploitation yields code execution at a higher privilege level than the attacker originally held.
No public proof-of-concept exploit is referenced in the advisory. The vulnerability mechanism is described in prose because verified exploit code is not available. See the Acronis Security Advisory SEC-3083 for vendor technical details.
Detection Methods for CVE-2026-42061
Indicators of Compromise
- Child processes spawned by DeviceLock DLP binaries executing under unexpected security contexts or with elevated tokens.
- Unusual file, registry, or service modifications originating from DeviceLock DLP process trees on Windows endpoints.
- DeviceLock DLP child processes loading user-writable DLLs or executing from non-standard paths.
Detection Strategies
- Inventory all Windows endpoints running Acronis DeviceLock DLP and identify hosts on builds earlier than 9.0.15051.93227.
- Monitor parent-child process relationships for DeviceLock DLP services, flagging child processes that perform privileged operations outside expected workflows.
- Correlate local logon events with subsequent DeviceLock DLP process activity to identify attempts to trigger privileged child process creation.
Monitoring Recommendations
- Enable Windows Security and Sysmon process creation logging (Event ID 4688, Sysmon Event ID 1) for DeviceLock DLP binaries.
- Audit token manipulation and handle duplication events involving DeviceLock DLP processes.
- Alert on privilege escalation patterns where a low-integrity user session is followed by high-integrity process actions linked to DeviceLock DLP.
How to Mitigate CVE-2026-42061
Immediate Actions Required
- Upgrade Acronis DeviceLock DLP for Windows to build 9.0.15051.93227 or later on all endpoints.
- Identify hosts where local users have interactive logon rights and prioritize patching those systems first.
- Review recent endpoint telemetry for anomalous DeviceLock DLP child process activity on unpatched hosts.
Patch Information
Acronis released a fixed build 9.0.15051.93227 for DeviceLock DLP on Windows that corrects the excessive permissions assigned to child processes. Administrators should consult Acronis Security Advisory SEC-3083 for the official patch package and deployment instructions. Apply the update through standard endpoint management workflows after validating the build in a test ring.
Workarounds
- Restrict interactive and remote desktop logon rights on systems running vulnerable DeviceLock DLP builds until patching is complete.
- Enforce least-privilege policies for standard users to reduce the attack surface available for local exploitation.
- Monitor and constrain process execution on affected endpoints using application control policies while the patch is rolled out.
# Verify installed Acronis DeviceLock DLP build on Windows (PowerShell)
Get-CimInstance -ClassName Win32_Product |
Where-Object { $_.Name -like "*DeviceLock*" } |
Select-Object Name, Version, Vendor
# Compare reported Version against the fixed build: 9.0.15051.93227
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
