{"id":"EM-20261111-ZT8V","url":"https://cyber.eventmonitor.net/incident/EM-20261111-ZT8V/critical-iperius-backup-vulnerability-cve-2026-112174/","type":"cve","title":"Critical Iperius Backup Vulnerability (CVE-2026-112174)","subtitle":"CVE-2026-112174","subject":"CVE-2026-112174","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-11T10:16:42.960Z","firstSignal":"2026-11-11T09:47:40.000Z","lastSignal":"2026-11-11T10:16:42.960Z","updated":"2026-11-11T11:34:41.211Z","revision":1,"life":[{"status":"Born","at":"2026-11-11T10:16:42.960Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-11T10:16:42.960Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-11T09:47:40.000Z","what":"First signal: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-11T10:16:42.960Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261111-ZT8V created."}],"stages":[{"name":"Disclosed","at":"2026-11-11T10:16:42.960Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-11T10:16:42.960Z","detail":"CVSS 9.3"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-11T09:47:40.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":4,"title":"EUVD-2026-123346 / CVE-2026-112174 (score 9.3)","text":"Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a…","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123346"},{"at":"2026-11-11T10:16:42.960Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-112174 (CVSS 9.3)","text":"Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112174"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-11T10:16:42.960","score":9.3,"severity":"CRITICAL","desc":"Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a…","product":"","seen":1794396881211},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}