Acronis DeviceLock DLP contains a DLL hijacking vulnerability that can be exploited locally to achieve privilege escalation. By placing a malicious DLL in a directory that the application searches, an attacker with user‑level access can execute code with the privileges of the DeviceLock service, enabling configuration changes or arbitrary code execution.

The vulnerability affects the Windows version of Acronis DeviceLock DLP prior to build 9.0.93212.

The CVSS score of 6.7 indicates moderate severity. EPSS is not available and the flaw is not listed in the CISA KEV catalogue, suggesting that exploitation is currently uncommon. Attackers would need local access to the server to place a rogue DLL, meaning the threat is confined to environments where users have file write or program execution rights on the same machine.