CVE-2026-50033 Overview
CVE-2026-50033 is a local privilege escalation vulnerability in Acronis DeviceLock DLP for Windows caused by uncontrolled search path element handling [CWE-427]. The flaw enables DLL hijacking, allowing a local authenticated user to load an attacker-controlled library into a privileged process. Successful exploitation grants elevated execution context on affected hosts. Acronis addressed the issue in DeviceLock DLP build 9.0.15051.93227 and later.
Critical Impact
A local attacker with low privileges can place a malicious DLL in a path searched by the DeviceLock DLP process and achieve high-impact compromise of confidentiality, integrity, and availability after user interaction.
Affected Products
- Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227
Discovery Timeline
- 2026-06-03 - CVE-2026-50033 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-50033
Vulnerability Analysis
The vulnerability resides in how Acronis DeviceLock DLP resolves library dependencies at runtime on Windows. The product loads one or more DLLs without specifying a fully qualified path or without restricting the search order to trusted system directories. This behavior is classified as Uncontrolled Search Path Element [CWE-427]. An attacker who can write a file into a directory that appears earlier in the search order than the legitimate library location can supply a malicious DLL. When DeviceLock DLP loads the dependency, the attacker-controlled code executes in the security context of the host process.
Root Cause
The root cause is improper restriction of the DLL search path inside the DeviceLock DLP installation. Windows resolves unqualified module names by walking a defined search order that can include the application directory, current working directory, and writable locations on PATH. When a high-privilege service or helper binary loads a library without using LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32 or an absolute path, an attacker-supplied DLL takes precedence over the intended file.
Attack Vector
Exploitation requires local access, low privileges, and user interaction. An attacker first stages a malicious DLL with a name matching one the DeviceLock DLP component attempts to load. The attacker places this file in a directory the loader searches before the legitimate location. When a user triggers the vulnerable DeviceLock DLP code path, the process loads the planted DLL and executes its DllMain entry point under elevated privileges. This produces local privilege escalation with high impact on confidentiality, integrity, and availability.
No public proof-of-concept exploit code is referenced in the advisory. See the Acronis Security Advisory SEC-3085 for vendor technical details.
Detection Methods for CVE-2026-50033
Indicators of Compromise
- Unexpected DLL files written into Acronis DeviceLock DLP installation directories or directories referenced by the system or user PATH variable.
- DeviceLock DLP processes loading modules from non-standard paths such as user profile directories, %TEMP%, or other writable locations.
- New child processes spawned by DeviceLock DLP service binaries that do not match expected helper executables.
Detection Strategies
- Hunt for image-load events where DeviceLock DLP processes load DLLs from directories outside C:\Program Files\ or C:\Windows\System32\.
- Correlate file creation events for .dll files in writable directories with subsequent loads by DeviceLock DLP components.
- Review Sysmon Event ID 7 (Image Loaded) records for DeviceLock DLP binaries and flag unsigned or unexpected publishers.
Monitoring Recommendations
- Enable image-load and process-creation telemetry on endpoints running DeviceLock DLP and ship it to a centralized analytics pipeline.
- Monitor write access to directories present in the DLL search path of DeviceLock DLP service accounts.
- Track changes to system and user PATH environment variables that could introduce attacker-controlled directories.
How to Mitigate CVE-2026-50033
Immediate Actions Required
- Upgrade Acronis DeviceLock DLP for Windows to build 9.0.15051.93227 or later as published in the Acronis Security Advisory SEC-3085.
- Audit DeviceLock DLP installation directories and remove any unauthorized DLL files.
- Restrict write permissions on directories referenced by the application search path to administrators only.
Patch Information
Acronis released a fixed version of DeviceLock DLP for Windows that addresses the uncontrolled search path behavior. Apply build 9.0.15051.93227 or newer. Refer to the Acronis Security Advisory SEC-3085 for full version coverage and download instructions.
Workarounds
- Remove writable directories from the system PATH environment variable that precede trusted application directories.
- Apply strict NTFS access control lists on DeviceLock DLP installation folders to prevent non-administrative write access.
- Limit interactive logon on hosts running DeviceLock DLP to reduce the population of users who can stage a malicious DLL.
# Configuration example: restrict write access to the DeviceLock DLP install directory
icacls "C:\Program Files\Acronis\DeviceLock" /inheritance:r
icacls "C:\Program Files\Acronis\DeviceLock" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
