CVE-2026-42061

Executive Summary

CVE-2026-42061 is a local privilege escalation vulnerability in Acronis DeviceLock DLP for Windows. The flaw arises from excessive permissions assigned to child processes, allowing a low-privileged local attacker to escalate their privileges to SYSTEM. The vulnerability affects all versions prior to build 9.0.15051.93227. With a CVSS score of 7.3, this vulnerability is considered high severity, though the attack vector is local, requiring an attacker to already have a foothold on the target system. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vendor has released a patched build, but the patch status was initially unknown.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows DLP (Data Loss Prevention) solution from Acronis. The supply chain risk is limited to the direct deployment of the vulnerable software within an organization.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.3 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a standard user account.
• User Interaction (UI): None (N) – No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full system compromise allows access to all data.
• Integrity (I): High (H) – The attacker can modify system files and configurations.
• Availability (A): High (H) – The attacker can disrupt system operations.

Threat Level: High. While the attack is local, the low privileges required and the high impact make it a significant risk for any organization using the vulnerable software. An attacker who gains initial access via phishing or other means can easily escalate to full system control.

Deep Dive & Mechanics

The vulnerability resides in how Acronis DeviceLock DLP manages child processes. The software, which runs with high privileges (often SYSTEM) to enforce DLP policies, spawns child processes to perform various tasks. Due to a misconfiguration, these child processes are assigned excessive permissions, specifically inheriting the high-integrity level of the parent process without proper restrictions.

Mechanism:

1. The main DeviceLock service (e.g., DLPService.exe) runs as SYSTEM.
2. When a specific event triggers a child process (e.g., a policy check, a file scan), the service creates a new process.
3. Instead of creating the child process with reduced privileges (e.g., as the logged-in user or with a restricted token), the child process is created with the same high-integrity token as the parent.
4. A local attacker with a standard user account can exploit this by:
   • Identifying the vulnerable child process (e.g., via process monitoring).
   • Using a technique like DLL hijacking, process injection, or manipulating the child process's environment (e.g., PATH variable) to execute arbitrary code.
   • The injected code runs with the child process's SYSTEM privileges, granting the attacker full control.

The core issue is a violation of the principle of least privilege. The child processes should be created with a restricted token that only has the necessary permissions for their specific task.

Vulnerable vs. Patched Code

Since the exact source code is proprietary, the following is a conceptual representation of the vulnerable and patched patterns.

Vulnerable Code (Conceptual C++):

// Vulnerable: Creates child process with inherited high-privilege token
BOOL CreateChildProcess(LPCWSTR lpApplicationName, LPCWSTR lpCommandLine) {
    STARTUPINFOW si = { sizeof(si) };
    PROCESS_INFORMATION pi;
    // No token manipulation - inherits parent's SYSTEM token
    if (CreateProcessW(lpApplicationName, lpCommandLine, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) {
        // Process created with SYSTEM privileges
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
        return TRUE;
    }
    return FALSE;
}

Patched Code (Conceptual C++):

// Patched: Creates child process with a restricted token
BOOL CreateChildProcess(LPCWSTR lpApplicationName, LPCWSTR lpCommandLine) {
    STARTUPINFOW si = { sizeof(si) };
    PROCESS_INFORMATION pi;
    HANDLE hToken = NULL;
    HANDLE hRestrictedToken = NULL;
    
    // Open the primary token of the calling process (SYSTEM)
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE | TOKEN_QUERY, &hToken)) {
        return FALSE;
    }
    
    // Create a restricted token (e.g., remove SeDebugPrivilege, set integrity to Medium)
    if (!CreateRestrictedToken(hToken, DISABLE_MAX_PRIVILEGES, 0, NULL, 0, NULL, 0, NULL, &hRestrictedToken)) {
        CloseHandle(hToken);
        return FALSE;
    }
    
    // Create process with the restricted token
    if (CreateProcessAsUserW(hRestrictedToken, lpApplicationName, lpCommandLine, NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi)) {
        CloseHandle(hToken);
        CloseHandle(hRestrictedToken);
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
        return TRUE;
    }
    
    CloseHandle(hToken);
    CloseHandle(hRestrictedToken);
    return FALSE;
}

The patched version uses CreateRestrictedToken to strip unnecessary privileges and lower the integrity level before creating the child process, preventing privilege escalation.

Exploitation & Lab Setup

Red Team

Objective: Escalate from a standard user account to SYSTEM on a Windows host running Acronis DeviceLock DLP (build < 9.0.15051.93227).

Prerequisites:

• Local access with a standard user account.
• Vulnerable version of Acronis DeviceLock DLP installed.

Steps:

1. Identify Vulnerable Process: Use Process Monitor (ProcMon) or a custom script to monitor process creation events. Look for child processes spawned by the main DeviceLock service (e.g., DLPService.exe). A common pattern is a process like DLPHelper.exe or DLPScanner.exe being created.
2. Choose Exploitation Technique: Since no public exploit exists, a common approach is DLL Hijacking.
   • Use ProcMon to identify a DLL that the child process attempts to load from a user-writable path (e.g., C:\Users\<username>\AppData\Local\Temp\).
   • Alternatively, if the child process searches the current working directory or PATH for a DLL, you can place a malicious DLL there.
3. Craft Malicious DLL: Create a DLL (e.g., evil.dll) that executes a payload (e.g., a reverse shell or a new user creation) in its DllMain function.

   // evil.cpp
   #include <windows.h>
   #pragma comment(lib, "user32.lib")
   
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           // Execute system command to create a new admin user
           system("net user attacker P@ssw0rd! /add");
           system("net localgroup administrators attacker /add");
       }
       return TRUE;
   }
   

   Compile: x86_64-w64-mingw32-gcc -shared -o evil.dll evil.cpp
4. Trigger the Vulnerability:
   • Place the malicious DLL in the path where the child process will load it.
   • Trigger the vulnerable functionality (e.g., by performing a file copy, USB insertion, or other DLP-monitored action).
5. Escalate: Once the child process runs, it loads your DLL, which executes with SYSTEM privileges, creating a new administrator account.

Alternative Technique: If the child process has a predictable command line, you can use Process Injection (e.g., via CreateRemoteThread) from a low-privilege process if the child process's handle is accessible.

Blue Team

Detection & Prevention:

1. Monitor Process Creation: Enable auditing for process creation (Event ID 4688). Look for child processes of DLPService.exe that are not expected.
2. DLL Load Monitoring: Use Sysmon (Event ID 7) to monitor DLL loads. Alert on any DLL loaded from user-writable paths (e.g., C:\Users\*\AppData\Local\Temp\) by high-integrity processes.
3. Restrict User Permissions: Ensure standard users do not have write access to directories where system processes load DLLs. Use AppLocker or Windows Defender Application Control (WDAC) to block unauthorized DLLs.
4. Apply the Patch: Immediately update to Acronis DeviceLock DLP build 9.0.15051.93227 or later.
5. Harden the System: Run the DeviceLock service with the least privileges necessary. If possible, configure the service to run as a virtual service account rather than SYSTEM.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Placeholder – actual hashes would be generated from the malicious DLL)
  • evil.dll: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names:
  • DLPService.exe (parent)
  • DLPHelper.exe (potential child)
  • DLPScanner.exe (potential child)
  • cmd.exe or powershell.exe spawned by a child process
• Network Connections: Outbound connections from unexpected processes (e.g., DLPHelper.exe) to external IPs (if a reverse shell is used).
• Registry Changes: New user accounts added to the Administrators group.
• Event Logs:
  • Event ID 4688 (Process Creation) showing a child process of DLPService.exe with unusual command-line arguments.
  • Event ID 7 (Sysmon – DLL Load) showing a DLL loaded from a user-writable path by a high-integrity process.

Detection Engineering

YARA Rule

rule CVE_2026_42061_DLL_Hijack {
    meta:
        description = "Detects potential DLL hijack payload targeting Acronis DeviceLock DLP child processes"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-42061"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "net user" ascii wide nocase
        $s2 = "net localgroup" ascii wide nocase
        $s3 = "CreateProcess" ascii wide
        $s4 = "DLL_PROCESS_ATTACH" ascii wide
    condition:
        uint16(0) == 0x5A4D and // MZ header
        (all of ($s1, $s2) or ($s3 and $s4))
}

Sigma Rule

title: CVE-2026-42061 - Acronis DeviceLock DLP Child Process Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious child processes spawned by Acronis DeviceLock DLP service that may indicate privilege escalation attempts.
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-42061
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\DLPService.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts triggered by DLP policies (rare)
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.42061

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-42061 - Potential Acronis DeviceLock DLP Reverse Shell";
    flow:to_server,established;
    content:"|48 65 6c 6c 6f|"; # "Hello" from a simple reverse shell
    sid:1000001;
    rev:1;
    reference:cve,2026-42061;
)

Remediation & Mitigation

1. Immediate Action: Upgrade to Acronis DeviceLock DLP (Windows) build 9.0.15051.93227 or later. This is the only official fix.
2. Workaround (if patching is delayed):
   • Restrict Child Process Execution: Use Windows Defender Application Control (WDAC) or AppLocker to block the execution of unauthorized executables spawned by DLPService.exe.
   • Disable Unnecessary Features: If possible, disable the specific DLP features that trigger the vulnerable child processes until a patch can be applied.
   • Monitor and Alert: Implement the detection rules provided in this report to identify any exploitation attempts.
3. Long-Term Hardening:
   • Apply the principle of least privilege to all services and applications.
   • Regularly audit software for excessive permissions.
   • Keep all software, especially security tools, up to date.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert