Acronis DeviceLock DLP contains a DLL hijacking flaw that permits a local attacker to run arbitrary code with elevated privileges. The vulnerability stems from inadequate protection of the DLL search order, allowing a malicious DLL to be loaded instead of the legitimate one. Successful exploitation grants full system access, potentially enabling further compromise of the local machine and the broader network if the device is privileged.

Windows installations of Acronis DeviceLock DLP before build 9.0.15051.93227 are affected. The issue is present only in versions that have not yet been patched to the referenced build number.

The CVSS score of 7.3 indicates a high severity risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, implying that a known exploit has not yet been publicly disclosed. The likely attack vector is local, requiring the attacker to have file‑system write access to a directory that the target process searches for DLLs. If such access is available, the attacker can place a malicious DLL and trigger execution through normal operation of the application.