CVE-2026-4822: Iperius Backup Privilege Escalation Flaw

CVE-2026-4822 Overview

A vulnerability has been identified in Enter Software Iperius Backup versions up to and including 8.7.3. The vulnerability affects the Backup Service component, specifically within the file handling operations in C:\ProgramData\IperiusBackup\Jobs\. This flaw enables the creation of temporary files with insecure permissions, potentially allowing local attackers to access or manipulate sensitive backup job data.

Critical Impact

Local attackers with low privileges can exploit insecure temporary file permissions in Iperius Backup to potentially access, modify, or disclose sensitive backup configuration and job data, leading to compromise of backup integrity or information disclosure.

Affected Products

• Enter Software Iperius Backup versions up to 8.7.3
• Iperius Backup Service component
• Windows systems with C:\ProgramData\IperiusBackup\Jobs\ directory

Discovery Timeline

• 2026-03-25 - CVE-2026-4822 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-4822

Vulnerability Analysis

This vulnerability is classified under CWE-377 (Insecure Temporary File), which occurs when an application creates temporary files in a manner that allows unauthorized access or manipulation. In the case of Iperius Backup, the Backup Service creates temporary files within the C:\ProgramData\IperiusBackup\Jobs\ directory with overly permissive access controls.

The exploitation of this vulnerability requires local access to the system and is considered difficult due to the high degree of complexity involved. An attacker would need to understand the specific timing and conditions under which these temporary files are created and persist on the filesystem.

Root Cause

The root cause of this vulnerability lies in improper permission settings applied to temporary files created by the Iperius Backup Service during backup job operations. When the service generates these files, it fails to properly restrict access permissions, allowing other local users on the system to potentially read or write to these files. This violates the principle of least privilege and creates an opportunity for local privilege escalation or information disclosure.

Attack Vector

The attack requires local access to the affected system. An attacker with low-level user privileges on a Windows system running a vulnerable version of Iperius Backup could monitor the C:\ProgramData\IperiusBackup\Jobs\ directory for temporary file creation. Due to the insecure permissions, the attacker may be able to:

1. Read sensitive backup job configuration data
2. Modify temporary files to alter backup behavior
3. Leverage the insecure file handling to escalate privileges

The attack complexity is high, requiring precise timing and knowledge of the application's file handling behavior. The exploit for this vulnerability has been made public, increasing the risk of exploitation in the wild.

For detailed technical analysis of this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-4822

Indicators of Compromise

• Unusual file access patterns in C:\ProgramData\IperiusBackup\Jobs\ directory by non-service accounts
• Modification timestamps on temporary files that don't align with scheduled backup operations
• Unexpected processes reading or writing to the Iperius Backup jobs directory
• Security event logs showing access denied errors followed by successful access to temporary files

Detection Strategies

• Monitor file system activity in C:\ProgramData\IperiusBackup\Jobs\ for access by non-privileged users
• Implement Windows Security Auditing on the affected directory to capture file access events
• Use SentinelOne's Behavioral AI to detect anomalous file access patterns in backup service directories
• Deploy endpoint detection rules to alert on temporary file manipulation by unauthorized processes

Monitoring Recommendations

• Enable Windows Object Access auditing for the C:\ProgramData\IperiusBackup\Jobs\ directory
• Configure SentinelOne to alert on file permission changes in application data directories
• Monitor process creation events for non-standard executables accessing Iperius Backup files
• Regularly audit file permissions on the affected directory to ensure proper access controls

How to Mitigate CVE-2026-4822

Immediate Actions Required

• Upgrade Iperius Backup to version 8.7.4 or later immediately
• Audit current file permissions on C:\ProgramData\IperiusBackup\Jobs\ directory
• Review system logs for potential past exploitation attempts
• Restrict local user access to systems running Iperius Backup where possible

Patch Information

Enter Software has released version 8.7.4 of Iperius Backup to address this vulnerability. The vendor responded professionally and released the fixed version promptly after responsible disclosure. Users should upgrade to version 8.7.4 or later to remediate this vulnerability. The updated software can be obtained from the Iperius Backup Software Download page.

Workarounds

• Manually restrict NTFS permissions on C:\ProgramData\IperiusBackup\Jobs\ to only allow access by the SYSTEM account and Administrators
• Limit local user accounts on systems running Iperius Backup to reduce attack surface
• Monitor the affected directory for unauthorized access until the patch can be applied
• Consider running Iperius Backup on isolated systems with minimal user access

# Windows PowerShell - Restrict permissions on affected directory
# Run as Administrator
icacls "C:\ProgramData\IperiusBackup\Jobs" /inheritance:r
icacls "C:\ProgramData\IperiusBackup\Jobs" /grant:r "SYSTEM:(OI)(CI)F"
icacls "C:\ProgramData\IperiusBackup\Jobs" /grant:r "Administrators:(OI)(CI)F"