{"id":"CVE-2026-112174","kind":"vulnerability","aliases":["CVE-2026-112174"],"related":[],"title":"Iperius Backup: local users can run programs as SYSTEM or Administrator","description":"Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.","summary":"Iperius Backup 8.8.3 has a privilege escalation flaw in its GUI, which runs with elevated rights and exposes native Windows dialogs. A local user with low privileges can use those dialogs to launch programs that inherit the elevated context, gaining SYSTEM or Administrator control of the Windows machine.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Iperius Backup","fixed":[],"affected":"8.8.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["iperius-backup","other","self-hosted","windows"],"not_affected_if":["no-local-low-privilege-users","non-elevated-service"],"how_to_check":"- Check the installed version in Iperius Backup's About dialog or Programs and Features; NVD names 8.8.3 (other versions unconfirmed).\n- Check whether the Iperius service/GUI runs persistently as Administrator/SYSTEM (services.msc, Task Manager > Details > User name) and whether non-admin users can sign in to the host.\n- Newer 8.8.9 changelog says service installs now restrict config folder permissions by default; it does not mention this CVE.","fix":null,"status":"open","published_at":"2026-11-11T10:16:42+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","triaged_at":"2026-11-11T10:27:00+00:00","updated_at":"2026-11-11T10:27:35+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T10:27:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Iperius Backup: local users can run programs as SYSTEM or Administrator","impact":"high","summary":"Iperius Backup 8.8.3 has a privilege escalation flaw in its GUI, which runs with elevated rights and exposes native Windows dialogs. A local user with low privileges can use those dialogs to launch programs that inherit the elevated context, gaining SYSTEM or Administrator control of the Windows machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","iperius-backup","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local low-privilege user gains SYSTEM or Administrator control","analyst_note":"Confirm the fixed version and vendor advisory for Iperius Backup; the NVD entry gave no fix, and the source names only 8.8.3.","how_to_check":"- Check the installed Iperius Backup version in the application's About dialog or Programs and Features; the flaw is stated for `8.8.3`.\n- Check whether the backup service runs persistently with Administrator privileges, as the source describes that configuration as required.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-elevated-service","no-local-low-privilege-users"],"who_is_affected":"The flaw requires the backup service to be configured to run persistently with Administrator privileges, and a local attacker with low privileges on the Windows machine. Systems running Iperius Backup with default or non-elevated service settings are less exposed, but the sources do not state the exact default configuration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000761,"input_tokens":4626,"output_tokens":596,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory for Iperius Backup; the NVD entry gave no fix, and the source names only 8.8.3.","search":"'-112174':14A,17A '-2026':13A,16A '8.8.3':30B,83C 'administr':11A,70B,113C,148C 'affect':159C 'allow':140C 'applic':130C,153C 'attack':117C 'backup':2A,19A,22B,29B,82C,105C 'command':141C 'compromis':157C 'configur':108C 'context':66B,138C,155C 'control':71B 'cve':12A,15A 'depend':150C 'dialog':48B,58B 'dialogu':126C 'due':84C 'elev':42B,65B,95C,137C 'escal':34B,78C 'execut':144C 'expos':45B,127C 'flaw':35B 'gain':67B 'graphic':90C 'gui':38B 'host':26B 'inherit':63B,135C 'insuffici':86C 'interfac':92C 'iperius':1A,18A,21B,28B,81C 'iperius-backup':20B 'launch':60B 'local':3A,50B,76C,98C,116C 'low':53B,101C,119C 'machin':75B 'nativ':46B,124C 'persist':111C 'privileg':33B,54B,77C,96C,102C,114C,120C,149C 'program':7A,61B 'programm':133C 'right':43B 'run':6A,40B,93C,110C,132C 'self':25B 'self-host':24B 'separ':87C 'servic':106C 'system':9A,68B,146C,161C 'use':56B,122C 'user':4A,51B,91C,99C 'vulner':79C 'window':27B,47B,74B,125C,160C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Iperius Backup 8.8.3 where the backup service runs persistently with Administrator privileges and untrusted low-privileged local users can log in (shared servers, terminal servers, workstations). Per NVD, such a user can use native Windows dialogs in the elevated GUI to launch programs as SYSTEM or Administrator. Single-user machines or non-elevated service setups can skip it; other 8.8.x versions are not confirmed either way.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["backup","iperiusbackup"],"ptokens":["backup","iperius"],"labels":["critical","iperiusbackup","other","selfhosted","windows"],"campaign_type":null,"search_a":"'-112174':14A,17A '-2026':13A,16A 'administr':11A 'backup':2A,19A 'cve':12A,15A 'iperius':1A,18A 'local':3A 'program':7A 'run':6A 'system':9A 'user':4A","search_b":"'8.8.3':30B 'administr':70B 'backup':22B,29B 'context':66B 'control':71B 'dialog':48B,58B 'elev':42B,65B 'escal':34B 'expos':45B 'flaw':35B 'gain':67B 'gui':38B 'host':26B 'inherit':63B 'iperius':21B,28B 'iperius-backup':20B 'launch':60B 'local':50B 'low':53B 'machin':75B 'nativ':46B 'privileg':33B,54B 'program':61B 'right':43B 'run':40B 'self':25B 'self-host':24B 'system':68B 'use':56B 'user':51B 'window':27B,47B,74B","search_c":"'8.8.3':83C 'administr':113C,148C 'affect':159C 'allow':140C 'applic':130C,153C 'attack':117C 'backup':82C,105C 'command':141C 'compromis':157C 'configur':108C 'context':138C,155C 'depend':150C 'dialogu':126C 'due':84C 'elev':95C,137C 'escal':78C 'execut':144C 'expos':127C 'graphic':90C 'inherit':135C 'insuffici':86C 'interfac':92C 'iperius':81C 'local':76C,98C,116C 'low':101C,119C 'nativ':124C 'persist':111C 'privileg':77C,96C,102C,114C,120C,149C 'programm':133C 'run':93C,110C,132C 'separ':87C 'servic':106C 'system':146C,161C 'use':122C 'user':91C,99C 'vulner':79C 'window':125C,160C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T10:16:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112174","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112174","severity":null,"published_at":"2026-11-11T10:16:42+00:00","modified_at":"2026-11-11T10:16:42+00:00","first_seen_at":"2026-11-11T10:26:48+00:00","fetched_at":"2026-11-11T10:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112174:3533","url":"https://www.iperiusbackup.es/news.aspx","severity":null,"published_at":"2026-11-11T10:27:35+00:00","modified_at":"2026-11-11T10:27:35+00:00","first_seen_at":"2026-11-11T10:27:35+00:00","fetched_at":"2026-11-11T10:27:35+00:00","note":"No vendor advisory or fixed version found for this CVE; only NVD (INCIBE CNA) names 8.8.3. Vendor changelog 8.8.9 (17.09.2026) hardens config-folder permissions by default when installed as a service, but does not cite this CVE and describes a different mechanism (job files, not GUI dialogs), so not treated as the fix. Not verified; fix left unknown. Settle by asking Enter Srl or INCIBE advisory.","cites":["https://www.iperiusbackup.es/news.aspx"]}],"documents":[{"id":124709,"url":"https://www.iperiusbackup.es/news.aspx","title":"Iperius Backup 8.8.9 changelog (Enter Srl)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}