This vulnerability (CVE-2026-42061) in Acronis DeviceLock DLP (Windows) involves improper permission assignment to child processes, classified under CWE-250 (Execution with Unnecessary Privileges). This flaw enables a local attacker with limited privileges to escalate their privileges on the affected system. The issue impacts versions prior to build 9.0.15051.93227. The CVSS score of 7.3 reflects high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Acronis as of the publication date.

Successful exploitation could allow a local attacker to gain elevated privileges, potentially leading to full system compromise including unauthorized access to sensitive data, modification of system settings, and disruption of services. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. However, exploitation requires local access and user interaction (UI:R).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local user access to trusted personnel only and monitor for suspicious local activity related to process permissions. Avoid running untrusted code on affected systems.