Skip to navigation

Threat reportVulnerabilityTL-2026-5748

Local Privilege Escalation in Iperius Backup 8.8.3 for Windows via Elevated GUI Native Dialogs (CVE-2026-112174)

highPATCHED

INCIBE-CERT (INCIBE-2026-854) reports a local privilege escalation in Iperius Backup 8.8.3 for Windows by ENTER: the elevated GUI is insufficiently separated from low-privilege local users, who can use native Windows dialogs to launch programs that inherit the elevated context. It applies when the backup service is configured to run persistently as Administrator; the vendor fixed it in 8.8.9.

Key facts

IdentifiersTL-2026-5748, CVE-2026-112174, CVE-2026-4824, CVE-2026-4822
Also known asINCIBE-2026-854
SeverityHIGH
CVSS9.3 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
First disclosed
Affected productsENTER (Enter Software) Iperius Backup for Windows
Weaknesses (CWE)CWE-250
ToolsIperius Backup 8.8.3, Iperius Backup 8.8.9
MITRE ATT&CK techniquesT1059 Command and Scripting Interpreter, T1078.003 Valid Accounts: Local Accounts, T1202 Indirect Command Execution, T1548 Abuse Elevation Control Mechanism
MotivationUNKNOWN
Target sectorstechnology, government administration, health, finance, education
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5748 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Iperius Backup Elevated Shell Breakout via Native Dialog (CVE-2026-112174)

Detects a command interpreter or script host (cmd, PowerShell, wscript, mshta, Windows Terminal) spawned directly by an Iperius Backup process while running at High/System integrity or as SYSTEM. This is the end state of the CVE-2026-112174 (CWE-250) abuse path: a low-privilege local user uses a native open/save/browse dialog in the elevated Iperius GUI to launch a program that inherits the elevated context. Iperius Backup 8.8.3 is affected; 8.8.9 is fixed.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1548, T1068, T1059, T1059.003
  • Data sources: sysmon, defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\Iperius*.exe" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\wt.exe") (IntegrityLevel="System" OR IntegrityLevel="High" OR User="NT AUTHORITY\\SYSTEM")
| eval threat="TL-2026-5748 CVE-2026-112174 Iperius elevated shell breakout"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User ParentImage Image IntegrityLevel threat
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName startswith "Iperius"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","wt.exe")
| where ProcessIntegrityLevel in~ ("System","High") or AccountName =~ "system"
| project Timestamp, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel
| order by Timestamp desc

Sigma

title: Iperius Backup Elevated Shell Child Process (CVE-2026-112174)
id: 5b1f3c7e-8a42-4d6b-9e10-2f7a6c4d1a01
status: experimental
description: Detects an elevated command interpreter spawned by an Iperius Backup process, the end state of the CVE-2026-112174 native-dialog privilege escalation.
references:
    - https://www.incibe.es/incibe-cert/alerta-temprana/avisos/escalada-de-privilegios-en-iperius-backup-de-enter
    - https://www.iperiusbackup.it/news.aspx
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1068
    - attack.execution
    - attack.t1059.003
    - cve.2026.112174
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\Iperius'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\wt.exe'
    selection_priv:
        IntegrityLevel:
            - 'System'
            - 'High'
    condition: all of selection_*
falsepositives:
    - Administrator-initiated maintenance scripts launched from the Iperius job configuration (pre/post-backup commands)
level: high

Known false positives:

  • Iperius pre/post-backup job commands that legitimately run cmd.exe or PowerShell as SYSTEM
  • Administrators opening a shell from the Iperius GUI during maintenance

Tuning notes: Baseline the pre/post-job commands your backup jobs run and exclude exact CommandLine values. Alert only when the interactive session user is not an administrator (join Sysmon 1 with 4624 type 2/10 by LogonId). Requires Sysmon EventCode 1 with IntegrityLevel; Security 4688 lacks it.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Iperius Backup Service Installed Under LocalSystem or Administrator (CVE-2026-112174 Precondition) · unlock with TL Creds
  • SYSTEM-Owned Shell Spawned by Explorer (Elevated Dialog Breakout Lineage) · unlock with TL Creds
  • Local Administrator Account Creation from SYSTEM Shell (Post-Escalation Persistence) · unlock with TL Creds
  • Iperius Backup Elevated Unexpected Child Process (CVE-2026-112174 Catch-All) · unlock with TL Creds
  • Iperius Backup GUI Running Elevated (CVE-2026-112174 Exposure Hunt) · unlock with TL Creds
  • Iperius Backup Service Account Set to LocalSystem or Administrator via Registry · unlock with TL Creds
  • Iperius Backup Configuration Files Written by Non-Service Account (CVE-2026-112174) · unlock with TL Creds
  • Iperius Backup Elevated Child Launched from Native Dialog Utilities (CVE-2026-112174) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5748.

Sample indicators (1 of 7)

  • Domain: www[.]iperiusbackup[.]it

Defanged, TLP:CLEAR. Full set of 7 indicators: unlock with TL Creds.

7 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

INCIBE-CERT published advisory INCIBE-2026-854 on 2026-11-11 for CVE-2026-112174, a local privilege escalation (CWE-250, Execution with Unnecessary Privileges) in Iperius Backup 8.8.3 for Windows from vendor ENTER (Enter Software). INCIBE, acting as CNA, rates it CVSS v4.0 9.3 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and importance High. The vulnerability was reported by Jonas Fernandez.

The Iperius Backup GUI runs with elevated privileges and is insufficiently isolated from low-privilege local users. When the backup service is configured to run persistently as Administrator, a local attacker can use native Windows dialogs exposed by the application (for example file-selection style dialogs) to launch programs that inherit the elevated security context. Depending on the application context this yields command execution as SYSTEM or Administrator. The attack is local only (no network vector) and requires a low-privileged local account and no user interaction.

Vendor remediation: Iperius Backup 8.8.9 (released 2026-09-17 per the vendor changelog) automatically applies restrictive permissions to the folders holding configuration files when the service is installed, so non-administrator users cannot create or modify configuration files or run backup jobs by default. This was previously an optional setting introduced in 8.7.4 (2026-02-25). The 8.8.9 release notes do not explicitly label this as a security fix but state the purpose is to prevent possible privilege escalation when Iperius is installed as a service.

The advisory lists exploitation as 'No'; no public PoC, IOCs, malware family or threat-actor attribution are stated for this CVE. Separately, earlier Iperius Backup flaws (CVE-2026-4822, CVE-2026-4823, CVE-2026-4824, affecting versions up to 8.7.3 and fixed in 8.7.4) have a public PoC repository by a third party; those are distinct issues and are listed here only as related context. Defenders should treat this as a hardening and detection-coverage item for hosts running Iperius Backup as a persistent elevated service.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078.003 Valid Accounts: Local Accounts

Defense Evasion

T1202 Indirect Command Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Remediation

Patches

  • Upgrade Iperius Backup to 8.8.9 or later (restrictive default permissions on configuration folders when the service is installed)

Immediate actions

  • Identify hosts running Iperius Backup 8.8.3 (and earlier 8.x builds) installed as a service
  • Avoid running the Iperius Backup service persistently as Administrator on multi-user or terminal-server hosts until patched
  • Restrict interactive logon of low-privilege users on hosts running the elevated Iperius GUI

Workarounds

  • Enable the restrictive ACL option on the configuration folder (introduced in 8.7.4) if upgrade is not immediately possible
  • Do not leave the Iperius Backup GUI open in an elevated session accessible to other local users

Longer-term hardening

  • Audit ACLs on Iperius Backup configuration folders and ensure non-administrators cannot create or modify files
  • Monitor for child processes spawned by the Iperius Backup GUI/service process from native Windows dialogs
  • Apply least-privilege service accounts for backup software where supported

Affected and fixed versions

  • ENTER (Enter Software) — Iperius Backup for Windows
    Vulnerable versions: 8.8.3
    Fixed in: 8.8.9

Timeline

  • Iperius Backup 8.7.4 adds an optional setting applying restrictive ACLs to the configuration folder and files (earlier fix for related CVE-2026-4822/4824 issues).
  • Related Iperius Backup flaw CVE-2026-4824 (versions up to 8.7.3) is published; a third-party advisory repository documents CVE-2026-4822, -4823 and -4824.
  • Iperius Backup 8.8.0 introduces AES-256-GCM / PBKDF2-HMAC-SHA256 / DPAPI protection for configuration files.
  • Iperius Backup 8.8.3 released (auto-update refreshes version/install date in Windows Control Panel); this is the build later listed as affected by CVE-2026-112174.
  • Iperius Backup 8.8.6 released (Google Cloud Storage compatibility, SFTP performance); no service-permission hardening in the release notes, so the default permissions gap persisted.
  • Iperius Backup 8.8.9 released: restrictive permissions on configuration folders are applied by default when the service is installed; non-administrators cannot create/modify configs or run backup jobs.
  • INCIBE-CERT publishes INCIBE-2026-854 / CVE-2026-112174 (CVSS v4.0 9.3, CWE-250) for Iperius Backup 8.8.3 on Windows; exploitation listed as 'No'.

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats