CVE-2026-41220 is a high-severity local privilege escalation vulnerability due to improper input validation (CWE-787) in Acronis DeviceLock DLP (Windows) and Acronis Cyber Protect Cloud Agent (Windows). It affects versions prior to build 9.0.93212 and 42183 respectively. The vulnerability allows a local attacker with limited privileges to potentially execute out-of-bounds writes, leading to full system compromise. The CVSS 3.0 vector indicates low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow a local attacker to escalate privileges on affected Windows systems, potentially gaining full control over the system. The vulnerability impacts confidentiality, integrity, and availability at a high level as per the CVSS score. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious activity related to privilege escalation attempts.