# Local Privilege Escalation in Iperius Backup 8.8.3 for Windows via Elevated GUI Native Dialogs (CVE-2026-112174)

> INCIBE-CERT (INCIBE-2026-854) reports a local privilege escalation in Iperius Backup 8.8.3 for Windows by ENTER: the elevated GUI is insufficiently separated from low-privilege local users, who can use native Windows dialogs to launch programs that inherit the elevated context. It applies when the backup service is configured to run persistently as Administrator; the vendor fixed it in 8.8.9.

- **Published:** 2026-11-11T09:26:48Z
- **Last reviewed:** 2026-11-11T09:26:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5748
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5748.png
- **ID:** TL-2026-5748
- **Severity:** HIGH (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 7 (1 shown free below)
- **CVEs:** CVE-2026-112174, CVE-2026-4824, CVE-2026-4822

## Description

INCIBE-CERT published advisory INCIBE-2026-854 on 2026-11-11 for CVE-2026-112174, a local privilege escalation (CWE-250, Execution with Unnecessary Privileges) in Iperius Backup 8.8.3 for Windows from vendor ENTER (Enter Software). INCIBE, acting as CNA, rates it CVSS v4.0 9.3 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and importance High. The vulnerability was reported by Jonas Fernandez.

The Iperius Backup GUI runs with elevated privileges and is insufficiently isolated from low-privilege local users. When the backup service is configured to run persistently as Administrator, a local attacker can use native Windows dialogs exposed by the application (for example file-selection style dialogs) to launch programs that inherit the elevated security context. Depending on the application context this yields command execution as SYSTEM or Administrator. The attack is local only (no network vector) and requires a low-privileged local account and no user interaction.

Vendor remediation: Iperius Backup 8.8.9 (released 2026-09-17 per the vendor changelog) automatically applies restrictive permissions to the folders holding configuration files when the service is installed, so non-administrator users cannot create or modify configuration files or run backup jobs by default. This was previously an optional setting introduced in 8.7.4 (2026-02-25). The 8.8.9 release notes do not explicitly label this as a security fix but state the purpose is to prevent possible privilege escalation when Iperius is installed as a service.

The advisory lists exploitation as 'No'; no public PoC, IOCs, malware family or threat-actor attribution are stated for this CVE. Separately, earlier Iperius Backup flaws (CVE-2026-4822, CVE-2026-4823, CVE-2026-4824, affecting versions up to 8.7.3 and fixed in 8.7.4) have a public PoC repository by a third party; those are distinct issues and are listed here only as related context. Defenders should treat this as a hardening and detection-coverage item for hosts running Iperius Backup as a persistent elevated service.

## MITRE ATT&CK

- T1548 Abuse Elevation Control Mechanism
- T1078.003 Valid Accounts: Local Accounts
- T1059 Command and Scripting Interpreter
- T1202 Indirect Command Execution

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Iperius Backup Elevated Shell Breakout via Native Dialog (CVE-2026-112174)** (`TL-2026-5748-SPL-001`)

Detects a command interpreter or script host (cmd, PowerShell, wscript, mshta, Windows Terminal) spawned directly by an Iperius Backup process while running at High/System integrity or as SYSTEM. This is the end state of the CVE-2026-112174 (CWE-250) abuse path: a low-privilege local user uses a native open/save/browse dialog in the elevated Iperius GUI to launch a program that inherits the elevated context. Iperius Backup 8.8.3 is affected; 8.8.9 is fixed.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1548, T1068, T1059, T1059.003
- **Data sources:** sysmon, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\Iperius*.exe" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\wt.exe") (IntegrityLevel="System" OR IntegrityLevel="High" OR User="NT AUTHORITY\\SYSTEM")
| eval threat="TL-2026-5748 CVE-2026-112174 Iperius elevated shell breakout"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User ParentImage Image IntegrityLevel threat
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName startswith "Iperius"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","wt.exe")
| where ProcessIntegrityLevel in~ ("System","High") or AccountName =~ "system"
| project Timestamp, DeviceName, AccountDomain, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel
| order by Timestamp desc
```

### Sigma

```yaml
title: Iperius Backup Elevated Shell Child Process (CVE-2026-112174)
id: 5b1f3c7e-8a42-4d6b-9e10-2f7a6c4d1a01
status: experimental
description: Detects an elevated command interpreter spawned by an Iperius Backup process, the end state of the CVE-2026-112174 native-dialog privilege escalation.
references:
    - https://www.incibe.es/incibe-cert/alerta-temprana/avisos/escalada-de-privilegios-en-iperius-backup-de-enter
    - https://www.iperiusbackup.it/news.aspx
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1068
    - attack.execution
    - attack.t1059.003
    - cve.2026.112174
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\Iperius'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\wt.exe'
    selection_priv:
        IntegrityLevel:
            - 'System'
            - 'High'
    condition: all of selection_*
falsepositives:
    - Administrator-initiated maintenance scripts launched from the Iperius job configuration (pre/post-backup commands)
level: high

```

**Known false positives:**

- Iperius pre/post-backup job commands that legitimately run cmd.exe or PowerShell as SYSTEM
- Administrators opening a shell from the Iperius GUI during maintenance

**Tuning notes:** Baseline the pre/post-job commands your backup jobs run and exclude exact CommandLine values. Alert only when the interactive session user is not an administrator (join Sysmon 1 with 4624 type 2/10 by LogonId). Requires Sysmon EventCode 1 with IntegrityLevel; Security 4688 lacks it.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Iperius Backup Service Installed Under LocalSystem or Administrator (CVE-2026-112174 Precondition) (locked: unlock with TL Creds)
- SYSTEM-Owned Shell Spawned by Explorer (Elevated Dialog Breakout Lineage) (locked: unlock with TL Creds)
- Local Administrator Account Creation from SYSTEM Shell (Post-Escalation Persistence) (locked: unlock with TL Creds)
- Iperius Backup Elevated Unexpected Child Process (CVE-2026-112174 Catch-All) (locked: unlock with TL Creds)
- Iperius Backup GUI Running Elevated (CVE-2026-112174 Exposure Hunt) (locked: unlock with TL Creds)
- Iperius Backup Service Account Set to LocalSystem or Administrator via Registry (locked: unlock with TL Creds)
- Iperius Backup Configuration Files Written by Non-Service Account (CVE-2026-112174) (locked: unlock with TL Creds)
- Iperius Backup Elevated Child Launched from Native Dialog Utilities (CVE-2026-112174) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 7)

Defanged, TLP:CLEAR.

- Domain: `www[.]iperiusbackup[.]it`

Full set of 7 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [INCIBE-CERT advisory INCIBE-2026-854: Escalada de privilegios en Iperius Backup de Enter](https://www.incibe.es/incibe-cert/alerta-temprana/avisos/escalada-de-privilegios-en-iperius-backup-de-enter)
- [Iperius Backup 8.8.9 changelog (vendor release notes)](https://www.iperiusbackup.it/news.aspx)
- [Iperius Backup product website](https://www.iperiusbackup.es/)
- [INCIBE-CERT early warning: CVE-2026-4824 (related Iperius Backup flaw, fixed in 8.7.4)](https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2026-4824)
- [Iperius Backup security advisories repository (related CVE-2026-4822/4823/4824)](https://github.com/0truust/iperius-backup-security-advisories)
- [NVD entry for related CVE-2026-4824](https://nvd.nist.gov/vuln/detail/CVE-2026-4824)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5748