CVE-2026-1995: IDrive Privilege Escalation Vulnerability

CVE-2026-1995 Overview

IDrive's id_service.exe process contains a local privilege escalation vulnerability that allows low-privileged users to execute arbitrary code with SYSTEM privileges. The service runs with elevated privileges and reads configuration files from the C:\ProgramData\IDrive\ directory, where UTF16-LE encoded contents are used as arguments for process execution. Due to improper access controls on these configuration files, any standard user logged into the system can modify them to specify a path to a malicious executable, which will then be executed by the id_service.exe process with SYSTEM-level privileges.

Critical Impact

This vulnerability enables any local user to escalate privileges to SYSTEM level by modifying insecure configuration files, potentially leading to complete system compromise.

Affected Products

• IDrive Backup Software (versions with vulnerable id_service.exe)
• Windows systems with IDrive installed under C:\ProgramData\IDrive\

Discovery Timeline

• 2026-03-24 - CVE-2026-1995 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-1995

Vulnerability Analysis

This vulnerability falls under the category of Insecure Permissions and Local Privilege Escalation. The id_service.exe process operates as a Windows service with SYSTEM privileges, providing it unrestricted access to the operating system. The service reads configuration data from files stored in C:\ProgramData\IDrive\, parsing the UTF16-LE encoded contents to determine which processes to spawn and with what arguments.

The fundamental security flaw lies in the access control configuration of these configuration files. While the service runs with elevated privileges, the files it reads are writable by standard (non-administrative) users on the system. This creates a privilege boundary violation where user-controlled input directly influences privileged operations.

Root Cause

The root cause is improper file system permissions on configuration files used by a privileged service. The configuration files under C:\ProgramData\IDrive\ lack appropriate access control lists (ACLs) that would restrict write access to administrators only. This allows any authenticated user to modify the contents of these files, effectively controlling the behavior of the privileged id_service.exe process.

Attack Vector

An attacker with local access to a Windows system running IDrive can exploit this vulnerability through the following mechanism:

1. The attacker identifies the configuration files in C:\ProgramData\IDrive\ that are read by id_service.exe
2. The attacker crafts a malicious payload (executable) and places it in an accessible location on the filesystem
3. The attacker modifies the configuration file to point to their malicious executable, encoding the path in UTF16-LE format
4. When id_service.exe next reads the configuration file (either on service restart or during its regular operation), it spawns the attacker's executable with SYSTEM privileges
5. The attacker gains full control over the system with the highest privilege level

This attack requires local access to the system but does not require administrative privileges, making it a significant threat in multi-user environments or scenarios where initial access has been gained through other means.

Detection Methods for CVE-2026-1995

Indicators of Compromise

• Unexpected modifications to files within C:\ProgramData\IDrive\ directory
• Unusual child processes spawned by id_service.exe that are not part of normal IDrive operations
• New or modified executable files in user-writable locations being executed with SYSTEM privileges
• Process creation events showing id_service.exe as the parent of suspicious executables

Detection Strategies

• Monitor file integrity of configuration files in C:\ProgramData\IDrive\ using file integrity monitoring (FIM) tools
• Implement process creation auditing to detect unusual child processes of id_service.exe
• Use endpoint detection and response (EDR) solutions to identify privilege escalation patterns where low-privilege user actions result in SYSTEM-level process execution
• Review Windows Security Event Logs for file modification events (Event ID 4663) on the IDrive configuration directory

Monitoring Recommendations

• Configure SentinelOne to monitor process trees originating from id_service.exe for anomalous behavior
• Enable detailed logging for file system access to the C:\ProgramData\IDrive\ directory
• Deploy behavioral analysis rules to detect configuration file manipulation followed by privileged process execution
• Implement alerts for any executable execution from non-standard paths when id_service.exe is the parent process

How to Mitigate CVE-2026-1995

Immediate Actions Required

• Restrict file system permissions on C:\ProgramData\IDrive\ to administrators only
• Audit current permissions on IDrive configuration files and remove write access for standard users
• Monitor for exploitation attempts using EDR solutions like SentinelOne
• Consider temporarily disabling the IDrive service on critical systems until patches are applied

Patch Information

Consult the CERT Vulnerability Advisory for the latest patch information and vendor guidance. Users should check with IDrive for security updates that address improper file permission handling in the id_service.exe component.

Workarounds

• Apply restrictive ACLs to the C:\ProgramData\IDrive\ directory and its contents to prevent non-administrative users from modifying configuration files
• Implement application whitelisting to prevent unauthorized executables from being spawned by id_service.exe
• Use Windows AppLocker or similar solutions to restrict which executables can be launched in the context of SYSTEM privileges
• Consider running the IDrive service under a less-privileged service account if operationally feasible

# PowerShell: Restrict permissions on IDrive configuration directory
# Remove inherited permissions and set explicit admin-only access
$path = "C:\ProgramData\IDrive"
$acl = Get-Acl $path
$acl.SetAccessRuleProtection($true, $false)
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Administrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule("NT AUTHORITY\SYSTEM","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$acl.AddAccessRule($adminRule)
$acl.AddAccessRule($systemRule)
Set-Acl $path $acl