Iperius Backup: Local privilege escalation (CVE-2026-112174)

Iperius Backup versions up to 8.8.3 contain a local privilege escalation vulnerability (CVE-2026-112174) due to improper isolation of native Windows dialogs. When the Iperius Backup service operates with administrative or SYSTEM privileges, it exposes dialogs that a local, low-privileged user can manipulate to execute arbitrary programs. This results in the inherited elevation of the malicious process. A proof of concept has been published by researchers, confirming the viability of the attack.

Impact

Successful exploitation allows a local user with minimal privileges to gain SYSTEM or Administrator-level execution rights on the host, potentially leading to full system compromise.

Recommendation

• Upgrade all instances of Iperius Backup to version 8.8.9 or later, which enforces restrictive permissions on configuration folders and prevents unauthorized interaction with backup service tasks.
• Inventory systems running vulnerable versions of Iperius Backup via EDR or asset management tools.
• Monitor for unauthorized modification of backup jobs or service-related folders by standard user accounts.