Threat video1:00
CVE-2026-112174 Iperius Backup LPE: Detection & IOCs
Low-privilege users can launch programs as Administrator via Iperius Backup 8.8.3 dialogs; 8.8.9 fixes it. 9 detection rules, 7 IOCs, a free Splunk SPL rule.
Read the full threat intel for CVE-2026-112174 Iperius Backup LPE: Detection & IOCs →
Chapters
- 0:00The hookA 9.3 flaw lets local users escalate privileges.
- 0:05The storyOnly when the service runs as Administrator.
- 0:11Attack pathReported, a low-privilege local account is enough.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to stealth.
- 0:43Remediation3 steps now: Identify hosts running Iperius Backup.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A 9.3 flaw lets local users escalate privileges.
0:05Only when the service runs as Administrator.
0:08Vendor fixed it in 8.8.9.
0:12Reported, a low-privilege local account is enough.
0:15The elevated GUI is insufficiently isolated.
0:18Native dialogs launch programs inheriting elevation.
0:22Commands can then execute as SYSTEM or Administrator.
0:29No threat actor is attributed. Confidence: low.
0:33No malicious indicators were published.
0:394 ATT&CK techniques, from initial access to stealth.
0:443 steps now: Identify hosts running Iperius Backup.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.