Iperius Backup: Local privilege escalation via GUI dialogues

Summary

Iperius Backup 8.8.3 for Windows contains a local privilege escalation flaw (CWE-250). If the backup service runs persistently with Administrator privileges, a local user with low privileges can use the native Windows dialogues in the application to start programmes that inherit the elevated context. This can lead to command execution with SYSTEM or Administrator rights and full compromise of the affected system. The flaw requires a local account and is not directly reachable from the internet.

Affected

• Iperius Backup 8.8.3 for Windows, when the backup service runs with Administrator privileges
• Default configuration: unaffected according to the CNA record

Fixed in

• Update to Iperius Backup 8.8.9 (stated in the INCIBE/CNA record; according to the manufacturer, this version applies restrictive permissions by default)
• Independent confirmation of the fix was not found at the time of research

Workaround

• Restrict local user access on systems running Iperius Backup with elevated privileges
• Where operationally possible, run the backup service under a least-privilege account and test backups afterwards
• Monitor the backup service and its job directory for unexpected processes

Exploitation

• No known exploitation reported
• No public proof of concept found for this CVE
• Earlier Iperius privilege escalation issues have public exploits; whether they work against 8.8.3 is unknown

Our recommendation

• Inventory Iperius Backup installations and identify version 8.8.3 and the service account
• Update to 8.8.9 or a later version once verified with the vendor
• Until patched, remove unnecessary local logons on affected hosts, especially multi-user servers and backup servers
• Monitor for suspicious child processes of the backup service

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  jonastrikex/CVE-2026-112174-Iperius-Backup-version-8.8.3-PoC

Research sources

• INCIBE-CERT notice INCIBE-2026-854 www.incibe.es
• OffSeq Radar: CVE-2026-112174 radar.offseq.com
• VulDB submission 774220 vuldb.com
• ExploitNotes: Iperius Backup service privilege escalation exploitnotes.org
• Exploit-DB 46863 (earlier Iperius issue, CVE-2019-25608) www.exploit-db.com
• Iperius security advisories (third-party repository) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:21.