# CVE-2026-41220: Acronis DeviceLock DLP and Cyber Protect Cloud Agent privilege escalation

Source: https://junglewise.ai/threats/cve-2026-41220-acronis-devicelock-dlp-and-cyber-protect-cloud-agent-privilege  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-29. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-41220 · Severity: high · CVSS 7.8 · Published 2026-04-29

Acronis security and data loss prevention software for Windows contains a vulnerability that allows a user with low-level access to gain full administrative control over the system. This could allow an attacker who has already gained a foothold on a computer to bypass security restrictions, access sensitive data, or disable protection services. Organizations should update their Acronis agents to the latest builds to prevent local privilege escalation.

Technologies: [Acronis Cyber Protect Cloud Agent](https://junglewise.ai/threats/technologies/cyber-protect-cloud-agent), [Acronis DeviceLock DLP](https://junglewise.ai/threats/technologies/devicelock-dlp). Vendors: [Acronis](https://junglewise.ai/threats/vendors/acronis).

## Quick answers

**Is CVE-2026-41220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41220 being exploited in the wild.

**How severe is CVE-2026-41220?** High severity, with a CVSS score of 7.8, published 29 April 2026.

**Which products and versions are affected?** Acronis Cyber Protect Cloud Agent before build 42183; Acronis DeviceLock DLP before build 9.0.93212.

**Is there a fix for CVE-2026-41220?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41220 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-41220?** Check whether you run Acronis Cyber Protect Cloud Agent or Acronis DeviceLock DLP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability exists in Acronis DeviceLock DLP and Cyber Protect Cloud Agent for Windows due to improper input validation. The root cause is identified as an out-of-bounds write (CWE-787) within the affected components. An attacker with local access and low-level privileges can exploit this flaw to execute code with higher privileges, potentially reaching SYSTEM level. The vulnerability is addressed in DeviceLock DLP build 9.0.93212 and Cyber Protect Cloud Agent build 42183. No user interaction is required for exploitation once local access is established.

## Affected products

- Acronis DeviceLock DLP (Windows) before build 9.0.93212
- Acronis Cyber Protect Cloud Agent (Windows) before build 42183

## Timeline

- 2026-04-29: disclosed: Initial advisory publication
- 2026-04-29: advisory: NVD record published

## References

- [https://security-advisory.acronis.com/advisories/SEC-10296](https://security-advisory.acronis.com/advisories/SEC-10296)

## Related threats

- [Acronis Cyber Protect Cloud Agent local privilege escalation](https://junglewise.ai/threats/cve-2025-30414-local-privilege-escalation-due-to-improper-authentication-the)
- [Acronis DeviceLock DLP local privilege escalation via DLL hijacking](https://junglewise.ai/threats/cve-2026-50033-acronis-devicelock-dlp-local-privilege-escalation-via-dll)
- [Acronis DeviceLock DLP local privilege escalation via DLL hijacking](https://junglewise.ai/threats/cve-2026-44682-acronis-devicelock-dlp-local-privilege-escalation-via-dll)
- [Acronis DeviceLock DLP local privilege escalation via EXE hijacking](https://junglewise.ai/threats/cve-2026-44609-acronis-devicelock-dlp-local-privilege-escalation-via-exe)
- [Acronis DeviceLock DLP local privilege escalation in child processes](https://junglewise.ai/threats/cve-2026-42061-acronis-devicelock-dlp-local-privilege-escalation-in-child)