Is CVE-2026-41220 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41220 being exploited in the wild.

How severe is CVE-2026-41220?

High severity, with a CVSS score of 7.8, published 29 April 2026.

Which products and versions are affected?

Acronis Cyber Protect Cloud Agent before build 42183; Acronis DeviceLock DLP before build 9.0.93212.

Is there a fix for CVE-2026-41220?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41220 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-41220?

Check whether you run Acronis Cyber Protect Cloud Agent or Acronis DeviceLock DLP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41220: Acronis DeviceLock DLP and Cyber Protect Cloud Agent privilege escalation

CVE-2026-41220 · Severity: high · CVSS 7.8 · Published 2026-04-29

Acronis security and data loss prevention software for Windows contains a vulnerability that allows a user with low-level access to gain full administrative control over the system. This could allow an attacker who has already gained a foothold on a computer to bypass security restrictions, access sensitive data, or disable protection services. Organizations should update their Acronis agents to the latest builds to prevent local privilege escalation.

Technologies: Acronis Cyber Protect Cloud Agent, Acronis DeviceLock DLP. Vendors: Acronis.

Quick answers

Is CVE-2026-41220 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41220 being exploited in the wild.
How severe is CVE-2026-41220?: High severity, with a CVSS score of 7.8, published 29 April 2026.
Which products and versions are affected?: Acronis Cyber Protect Cloud Agent before build 42183; Acronis DeviceLock DLP before build 9.0.93212.
Is there a fix for CVE-2026-41220?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41220 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-41220?: Check whether you run Acronis Cyber Protect Cloud Agent or Acronis DeviceLock DLP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in Acronis DeviceLock DLP and Cyber Protect Cloud Agent for Windows due to improper input validation. The root cause is identified as an out-of-bounds write (CWE-787) within the affected components. An attacker with local access and low-level privileges can exploit this flaw to execute code with higher privileges, potentially reaching SYSTEM level. The vulnerability is addressed in DeviceLock DLP build 9.0.93212 and Cyber Protect Cloud Agent build 42183. No user interaction is required for exploitation once local access is established.

Affected products

Acronis DeviceLock DLP (Windows) before build 9.0.93212
Acronis Cyber Protect Cloud Agent (Windows) before build 42183

Timeline

2026-04-29: disclosed: Initial advisory publication
2026-04-29: advisory: NVD record published

References

https://security-advisory.acronis.com/advisories/SEC-10296

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.