IPERIUS BACKUP · CVE-2026-112174 · Other
NO FIX YET
Iperius Backup 8.8.3 has a privilege escalation flaw in its GUI, which runs with elevated rights and exposes native Windows dialogs. A local user with low privileges can use those dialogs to launch programs that inherit the elevated context, gaining SYSTEM or Administrator control of the Windows machine.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Windows machines running Iperius Backup 8.8.3 where the backup service runs persistently with Administrator privileges and untrusted low-privileged local users can log in (shared servers, terminal servers, workstations). Per NVD, such a user can use native Windows dialogs in the elevated GUI to launch programs as SYSTEM or Administrator. Single-user machines or non-elevated service setups can skip it; other 8.8.x versions are not confirmed either way.
Not affected if no-local-low-privilege-users, non-elevated-service
Who cares iperius-backup, self-hosted, windows
Unknown from the sources.
Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.