CVE-2026-4823: Iperius Backup Information Disclosure Flaw

CVE-2026-4823 Overview

CVE-2026-4823 is an information disclosure vulnerability affecting Enter Software Iperius Backup versions up to 8.7.3. The vulnerability exists within the NTLM2 Handler component and can lead to credential exposure through NTLM relay attacks. This security flaw requires local access and is considered highly complex to exploit, making practical attacks difficult but not impossible for determined threat actors with physical or remote console access to affected systems.

Critical Impact

Local attackers with low privileges can potentially extract sensitive authentication credentials through manipulation of the NTLM2 Handler, leading to information disclosure that could be leveraged for lateral movement within enterprise environments.

Affected Products

• Enter Software Iperius Backup versions up to 8.7.3
• Systems utilizing NTLM2 authentication through Iperius Backup
• Windows environments running vulnerable Iperius Backup installations

Discovery Timeline

• 2026-03-25 - CVE-2026-4823 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-4823

Vulnerability Analysis

This vulnerability stems from improper handling of NTLM authentication data within the NTLM2 Handler component of Iperius Backup. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the application fails to adequately protect authentication-related data during NTLM2 processing operations.

The vulnerability requires local access to exploit, meaning an attacker must already have some level of access to the target system. Additionally, the attack complexity is high, requiring specific conditions to be met and sophisticated techniques to successfully extract credential information. The exploitation path involves manipulating the NTLM2 Handler to expose authentication credentials that could then be relayed or cracked offline.

Root Cause

The root cause lies in the NTLM2 Handler component's failure to properly secure sensitive authentication material during processing. NTLM (NT LAN Manager) authentication involves credential hashes that, if exposed, can be used in relay attacks or offline password cracking attempts. The vulnerable component does not adequately protect these credential artifacts, allowing a local attacker with low privileges to potentially intercept or extract this sensitive information.

Attack Vector

The attack vector is local, requiring the attacker to have existing access to the target system. The exploitation process involves:

1. The attacker gains local access to a system running a vulnerable version of Iperius Backup
2. Through manipulation of the NTLM2 Handler functionality, the attacker triggers credential exposure
3. The exposed NTLM credentials can then be used for relay attacks or offline cracking
4. Successfully captured credentials may enable privilege escalation or lateral movement

Due to the high complexity of this attack, successful exploitation requires significant technical expertise and specific environmental conditions. The vulnerability has been publicly disclosed, and exploit information has been made available, which increases the risk for organizations running unpatched systems.

Detection Methods for CVE-2026-4823

Indicators of Compromise

• Unusual NTLM authentication traffic patterns originating from Iperius Backup processes
• Suspicious local access attempts to Iperius Backup configuration or credential stores
• Evidence of NTLM relay attack tools such as Responder or ntlmrelayx running on local systems
• Anomalous credential usage patterns following Iperius Backup execution

Detection Strategies

• Monitor for local process interactions with the Iperius Backup NTLM2 Handler component
• Implement endpoint detection rules to identify known NTLM relay attack tool signatures
• Enable Windows Security Event logging for NTLM authentication events (Event IDs 4776, 4624)
• Deploy behavioral analysis to detect credential harvesting activities on systems running Iperius Backup

Monitoring Recommendations

• Enable detailed audit logging for Iperius Backup service activities
• Configure SIEM rules to alert on anomalous NTLM authentication patterns
• Monitor for unauthorized local access attempts to systems running vulnerable Iperius Backup versions
• Implement file integrity monitoring for Iperius Backup installation directories

How to Mitigate CVE-2026-4823

Immediate Actions Required

• Upgrade Iperius Backup to version 8.7.4 or later immediately
• Audit all systems running Iperius Backup to identify vulnerable installations
• Restrict local access to systems running Iperius Backup to only essential personnel
• Review authentication logs for any signs of credential exposure or misuse

Patch Information

Enter Software has addressed this vulnerability in Iperius Backup version 8.7.4. The vendor was contacted during responsible disclosure and responded professionally, quickly releasing a fixed version. Organizations should prioritize upgrading to the patched version as the exploit has been publicly disclosed.

The updated software is available from the official Iperius Backup download page. Additional technical details regarding the vulnerability can be found in the GitHub Security Advisory and the VulDB entry.

Workarounds

• Implement strict network segmentation to limit lateral movement if credentials are compromised
• Enable SMB signing to mitigate NTLM relay attacks as an interim measure
• Consider disabling NTLM authentication in favor of Kerberos where possible
• Apply principle of least privilege to limit the impact of any credential exposure

# Enable SMB signing as a temporary mitigation (Windows Group Policy)
# Set the following registry values on affected systems:
reg add "HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters" /v RequireSecuritySignature /t REG_DWORD /d 1 /f
reg add "HKLM\System\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v RequireSecuritySignature /t REG_DWORD /d 1 /f