Vulnerability in Enter Iperius Backup
CVE-2026-112174
Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.
Published .
EPSS exploit prediction
FIRST.org has not scored this CVE yet. About EPSS.
Affected products
- Enter Iperius Backup — versions 8.8.3 for Windows
Weakness classification (CWE)
Public exploits and proof-of-concept code
1 public repository with exploit or proof-of-concept code for this CVE:
- jonastrikex/CVE-2026-112174-Iperius-Backup-version-8.8.3-PoC (last pushed 2026-11-11): Privilege escalation in Enter’s Iperius Backup
References
This CVE has public exploit evidence. See the latest CVEs with public exploits.