---
id: "CVE-2026-112174"
page: "https://infrastack.ai/live/CVE-2026-112174"
kind: "vulnerability"
aliases: ["CVE-2026-112174"]
title: "Iperius Backup: local users can run programs as SYSTEM or Administrator"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Iperius Backup", "fixed": [], "affected": "8.8.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["iperius-backup", "other", "self-hosted", "windows"]
not_affected_if: ["no-local-low-privilege-users", "non-elevated-service"]
published_at: "2026-11-11T10:16:42+00:00"
first_seen_at: "2026-11-11T10:26:48+00:00"
updated_at: "2026-11-11T10:27:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112174", "first_seen_at": "2026-11-11T10:26:48+00:00"}, {"source": "analyst", "url": "https://www.iperiusbackup.es/news.aspx", "first_seen_at": "2026-11-11T10:27:35+00:00", "cites": ["https://www.iperiusbackup.es/news.aspx"]}]
exploit_sources: []
---

# Iperius Backup: local users can run programs as SYSTEM or Administrator

Link for people: https://infrastack.ai/live/CVE-2026-112174 (this .md is for agents)

Iperius Backup 8.8.3 has a privilege escalation flaw in its GUI, which runs with elevated rights and exposes native Windows dialogs. A local user with low privileges can use those dialogs to launch programs that inherit the elevated context, gaining SYSTEM or Administrator control of the Windows machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Iperius Backup affected 8.8.3 fixed no fixed version listed

## How to check

- Check the installed version in Iperius Backup's About dialog or Programs and Features; NVD names 8.8.3 (other versions unconfirmed).
- Check whether the Iperius service/GUI runs persistently as Administrator/SYSTEM (services.msc, Task Manager > Details > User name) and whether non-admin users can sign in to the host.
- Newer 8.8.9 changelog says service installs now restrict config folder permissions by default; it does not mention this CVE.

## Timeline

- 2026-11-11T10:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112174
- 2026-11-11T10:27:35+00:00 analyst https://www.iperiusbackup.es/news.aspx — No vendor advisory or fixed version found for this CVE; only NVD (INCIBE CNA) names 8.8.3. Vendor changelog 8.8.9 (17.09.2026) hardens config-folder permissions by default when installed as a service, but does not cite this CVE and describes a different mechanism (job files, not GUI dialogs), so not treated as the fix. Not verified; fix left unknown. Settle by asking Enter Srl or INCIBE advisory.

## Documents

- [mentions] Iperius Backup 8.8.9 changelog (Enter Srl) https://www.iperiusbackup.es/news.aspx

## From the sources

Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_