Is CVE-2026-41952 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41952 being exploited in the wild.

How severe is CVE-2026-41952?

High severity, with a CVSS score of 7.8, published 29 April 2026.

Which products and versions are affected?

Acronis Cyber Protect Cloud Agent before build 42183; Acronis DeviceLock DLP before build 9.0.93212.

Is there a fix for CVE-2026-41952?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-41952 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-41952?

Check whether you run Acronis Cyber Protect Cloud Agent or Acronis DeviceLock DLP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41952: Acronis Windows Agents local privilege escalation via improper input validation

CVE-2026-41952 · Severity: high · CVSS 7.8 · Published 2026-04-29

Acronis security and data loss prevention agents for Windows are affected by a vulnerability that allows a user with low-level access to gain full administrative control over the system. This could allow an attacker to bypass security policies, access sensitive data, or disable protection software. Organizations should update their Acronis agents to the latest builds to prevent local users from escalating their privileges.

Technologies: Acronis Cyber Protect Cloud Agent, Acronis DeviceLock DLP. Vendors: Acronis.

Quick answers

Is CVE-2026-41952 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41952 being exploited in the wild.
How severe is CVE-2026-41952?: High severity, with a CVSS score of 7.8, published 29 April 2026.
Which products and versions are affected?: Acronis Cyber Protect Cloud Agent before build 42183; Acronis DeviceLock DLP before build 9.0.93212.
Is there a fix for CVE-2026-41952?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-41952 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-41952?: Check whether you run Acronis Cyber Protect Cloud Agent or Acronis DeviceLock DLP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in Acronis DeviceLock DLP and Cyber Protect Cloud Agent for Windows due to improper input validation, specifically a 'write-what-where' condition (CWE-123). An attacker with low-privileged local access can exploit this flaw to overwrite sensitive memory or system files, leading to the execution of arbitrary code with SYSTEM-level privileges. The vulnerability is addressed in DeviceLock DLP build 9.0.93212 and Cyber Protect Cloud Agent build 42183. Exploitation does not require user interaction or complex configurations.

Affected products

Acronis DeviceLock DLP (Windows) before build 9.0.93212
Acronis Cyber Protect Cloud Agent (Windows) before build 42183

Timeline

2026-04-29: disclosed
2026-04-29: advisory

References

https://security-advisory.acronis.com/advisories/SEC-7790

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.