CVE-2026-16157: Duplicati Privilege Escalation Vulnerability

CVE-2026-16157 Overview

CVE-2026-16157 affects Duplicati v2.3.0.1 backup software on Windows. The installer grants the built-in Authenticated Users group MODIFY permissions that propagate to every subdirectory under the installation path. When administrators install Duplicati outside of Program Files or to a custom path, the resulting directory inherits these weak Access Control Lists (ACLs). Because the Duplicati service runs as LocalSystem, any standard local user can overwrite a Dynamic Link Library (DLL) in the service directory. On the next service restart, Windows loads the attacker-controlled DLL and executes code as SYSTEM.

Critical Impact
Any standard local user can escalate to SYSTEM privileges by replacing a DLL in a non-default Duplicati installation directory.

Affected Products

Duplicati v2.3.0.1 (Windows installations)
Installations placed outside C:\Program Files\ or C:\Program Files (x86)\
Custom-path deployments where the parent directory grants Authenticated Users write access

Discovery Timeline

2026-07-22 - CVE-2026-16157 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16157

Vulnerability Analysis

Duplicati v2.3.0.1 does not explicitly harden the ACLs of its installation directory during setup. When an administrator installs the software to a location outside Program Files, the destination directory inherits permissions from its parent. On typical Windows systems, custom paths such as C:\Duplicati\ or D:\Apps\Duplicati\ grant the Authenticated Users group MODIFY rights by default. Those permissions propagate to every file and subdirectory that the installer creates.

The Duplicati Windows service is registered to run under the LocalSystem account. During service startup, the Windows loader resolves and loads all binaries referenced by the service executable from that same directory. A low-privileged attacker who overwrites a legitimate DLL with a malicious one has their code executed with SYSTEM privileges on the next service start or system reboot.

Root Cause

The root cause is an insecure permissions configuration [CWE-276] combined with a LocalSystem service running from a user-writable path. Duplicati does not enforce restrictive ACLs on its own installation folder when the target path lies outside a protected system directory.

Attack Vector

An attacker requires local, authenticated access to the target host. The attack proceeds as follows: the attacker enumerates the Duplicati service binary path, confirms write access to the directory, replaces a DLL loaded by the service with a crafted payload, and waits for the service to restart. The unmanaged loader executes the attacker's DLL before any managed .NET code runs, so no application-layer defense intercepts the execution.

No verified exploit code is publicly published. See the CERT Vulnerability Advisory #847406 for additional technical detail.

Detection Methods for CVE-2026-16157

Indicators of Compromise

Unexpected modification timestamps on DLL files inside the Duplicati installation directory
New or modified DLLs in the Duplicati directory whose Authenticode signature does not match the vendor
Process creation events where the Duplicati service parent (LocalSystem) spawns unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe
Service restart events for the Duplicati service that correlate with prior file writes by non-administrative users

Detection Strategies

Audit ACLs on the Duplicati installation directory and flag any grant of Modify or Write to Authenticated Users, Users, or Everyone
Monitor file integrity of every DLL under the Duplicati installation path and alert on writes by non-SYSTEM, non-Administrator principals
Correlate Windows Security Event ID 4663 (object access) on the Duplicati folder with Service Control Manager Event ID 7036 (service state change)

Monitoring Recommendations

Enable object access auditing on the Duplicati installation directory using Windows Advanced Audit Policy
Ingest Sysmon Event ID 11 (file create) and Event ID 7 (image loaded) for the Duplicati service process into a centralized logging platform
Track service binary and DLL hashes and alert on drift from a known-good baseline

How to Mitigate CVE-2026-16157

Immediate Actions Required

Inventory all Windows hosts running Duplicati v2.3.0.1 and identify installations placed outside Program Files
Manually harden ACLs on any non-standard Duplicati installation directory to remove Modify rights from Authenticated Users and Users
Reinstall Duplicati into the default Program Files location where the directory inherits system-protected ACLs
Restrict local logon rights on servers running Duplicati to reduce the pool of accounts that could exploit the flaw

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry for CVE-2026-16157. Consult the CERT Vulnerability Advisory #847406 and the Duplicati project release notes for the latest fixed version and remediation guidance.

Workarounds

Reinstall Duplicati under C:\Program Files\ so the installation inherits the restrictive default ACL
Remove Authenticated Users and Users from the discretionary ACL of the Duplicati folder and grant only SYSTEM and Administrators write access
Reconfigure the Duplicati service to run under a dedicated least-privilege service account rather than LocalSystem where operationally feasible

bash

# Configuration example: harden ACLs on a custom Duplicati install path
icacls "C:\Duplicati" /remove:g "Authenticated Users"
icacls "C:\Duplicati" /remove:g "Users"
icacls "C:\Duplicati" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\Duplicati" /inheritance:r