This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Acronis fixes 4 vulnerabilities
Acronis fixes 4 high-severity vulnerabilities by releasing Acronis DeviceLock DLP 9.0 Update 7 for Windows systems [1].
An authenticated local attacker can escalate their privileges using an EXE hijacking attack [2].
The vulnerability is present in product:
- Windows:Acronis DeviceLock DLP; <9.0.15051.93227;
CVSS: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-44609 at cve.org, NVD
- CWE-427: Uncontrolled Search Path Element at cwe.mitre.org
The vulnerability was publicly disclosed 3. 6. 2026.
An authenticated local attacker can escalate their privileges using a DLL hijacking attack [3][4].
The vulnerability is present in product:
- Windows:Acronis DeviceLock DLP; <9.0.15051.93227;
CVSS: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-44682 at cve.org, NVD
- CVE-2026-50033 at cve.org, NVD
- CWE-427: Uncontrolled Search Path Element at cwe.mitre.org
The vulnerability was publicly disclosed 3. 6. 2026.
An authenticated local attacker can escalate their privileges due to excessive privileges being assigned to child processes [5].
The vulnerability is present in product:
- Windows:Acronis DeviceLock DLP; <9.0.15051.93227;
CVSS: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-42061 at cve.org, NVD
- CWE-250: Execution with Unnecessary Privileges at cwe.mitre.org
The vulnerability was publicly disclosed 3. 6. 2026.
Links
- [1] https://security-advisory.acronis.com/advisories
- [2] https://security-advisory.acronis.com/advisories/SEC-3084
- [3] https://security-advisory.acronis.com/advisories/SEC-11249
- [4] https://security-advisory.acronis.com/advisories/SEC-3085
- [5] https://security-advisory.acronis.com/advisories/SEC-3083
By CESNET, z.s.p.o. Táňa Macháčková on 5. 6. 2026.