Acronis DeviceLock DLP is vulnerable to local privilege escalation through an EXE hijacking flaw, a form of path manipulation where a malicious file can replace or alter a legitimate executable, enabling an attacker to run code with elevated rights. This weakness is catalogued as CWE-427. The vulnerability allows a user with local access to gain higher privileges, potentially compromising the entire system.

Products affected are Acronis DeviceLock DLP for Windows; any installation prior to build 9.0.15051.93227 is impacted.

The CVSS score of 7.3 indicates moderate to high severity, and while the EPSS score is not provided, the flaw is not listed in CISA's KEV catalog, suggesting it is not widely exploited yet. Exploitation requires local user context, with an attacker replacing a legitimate executable or manipulating file paths to execute malicious code. Successful exploitation results in elevated user privileges rather than remote code execution, but can lead to full system compromise if the privileged process has broad access.