This vulnerability (CVE-2026-25852) affects Acronis DeviceLock DLP on Windows platforms prior to build 9.0.93212. It involves DLL hijacking, a common technique where an attacker places a malicious DLL in a location that is loaded by a legitimate application, enabling local privilege escalation. The CVSS 3.0 vector indicates the attack requires local access with high attack complexity, low privileges, and user interaction, but can result in high impact on confidentiality, integrity, and availability. The vendor has not published a patch or official remediation details as of the publication date.

Successful exploitation could allow a local attacker with limited privileges and user interaction to escalate their privileges, potentially gaining higher system rights. This could lead to unauthorized access to sensitive data, modification of system files, or disruption of system availability. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local user access and avoid executing untrusted code. Monitor for updates from Acronis regarding patches or workarounds specific to this vulnerability.