CVE-2026-57919 Overview
CVE-2026-57919 is a local privilege escalation vulnerability in PBackupVSS.exe, a component of Matrix42 Empirum. The service creates a named pipe at \\.\pipe\PBackupVSS with a Discretionary Access Control List (DACL) that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. A low-privileged local attacker can connect to the pipe, send crafted Inter-Process Communication (IPC) messages, and trigger execution of arbitrary commands as SYSTEM through an untrusted search path. The flaw is classified under [CWE-276] Incorrect Default Permissions.
Critical Impact
Any authenticated local user can escalate to SYSTEM by planting a malicious shadow.exe in a controlled working directory and invoking the affected IPC handler.
Affected Products
- Matrix42 Empirum versions prior to 25.5
- Matrix42 Empirum 26.x versions prior to 26.2
- PBackupVSS.exe (Empirum Personal Backup component)
Discovery Timeline
- 2026-06-29 - CVE-2026-57919 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-57919
Vulnerability Analysis
The PBackupVSS.exe service exposes a named pipe endpoint used for Volume Shadow Copy Service (VSS) operations. The pipe is created with an overly permissive DACL that allows the Authenticated Users group both read and write access. This design permits any interactive or remote-authenticated local user to open a handle to the pipe and exchange IPC messages with the privileged service. The service processes these messages and, as part of its workflow, launches a child process named shadow.exe without specifying an absolute path or validating the search order. Attackers can supply a working directory containing an attacker-controlled shadow.exe, which the service then executes with SYSTEM privileges. The combination of a permissive pipe DACL and an untrusted search path (CWE-427-adjacent behavior compounded by CWE-276) produces reliable local privilege escalation.
Root Cause
The root cause is the assignment of an insecure DACL during named pipe creation. The service does not restrict access to administrators or its own security principal. In parallel, the service invokes shadow.exe using a relative reference resolved against a caller-influenced working directory, so search-path resolution favors the attacker's binary over any legitimate copy.
Attack Vector
Exploitation requires local, authenticated access with low privileges. The attacker performs three steps: (1) place a malicious shadow.exe in a directory the attacker controls; (2) open a handle to \\.\pipe\PBackupVSS and send an IPC request that causes the service to switch working directory to the attacker-controlled path; and (3) trigger the code path that spawns shadow.exe. The service resolves the binary from the untrusted directory and runs it as SYSTEM, yielding full system compromise. No user interaction and no network access are required. Refer to the Matrix42 CVE-2026-57919 Advisory for vendor technical details.
Detection Methods for CVE-2026-57919
Indicators of Compromise
- Presence of a shadow.exe binary outside the legitimate Matrix42 Empirum installation directories, particularly in user-writable paths such as %TEMP%, %APPDATA%, or C:\Users\Public.
- Process creation events showing PBackupVSS.exe (running as SYSTEM) spawning shadow.exe from a non-standard directory.
- Unexpected client connections to the named pipe \\.\pipe\PBackupVSS originating from non-administrative user sessions.
Detection Strategies
- Monitor Windows Security Event ID 4688 and Sysmon Event ID 1 for PBackupVSS.exe child processes where the image path resolves outside the Empirum program directory.
- Enable Sysmon Event ID 17/18 (named pipe created/connected) and alert on connections to PBackupVSS from low-privileged users.
- Correlate parent-child process lineage where a SYSTEM-owned parent executes a binary residing in a user-writable directory.
Monitoring Recommendations
- Baseline the legitimate install path of PBackupVSS.exe and shadow.exe, then alert on any execution from unexpected locations.
- Audit named pipe DACLs on Empirum-managed hosts using tools such as accesschk.exe -w \pipe\PBackupVSS.
- Ingest endpoint process, file, and pipe telemetry into a centralized analytics platform to hunt for lateral privilege escalation patterns across managed workstations.
How to Mitigate CVE-2026-57919
Immediate Actions Required
- Upgrade Matrix42 Empirum to version 25.5 or later, or to 26.2 or later on the 26.x branch.
- Inventory endpoints running PBackupVSS.exe and prioritize patching hosts accessible to interactive users.
- Restrict local logon rights on Empirum-managed systems to reduce the pool of attackers able to reach the pipe.
Patch Information
Matrix42 has released fixed builds that correct the pipe DACL and enforce an absolute path when launching shadow.exe. Consult the Matrix42 CVE-2026-57919 Advisory for exact fixed version identifiers and installer packages.
Workarounds
- If patching is not immediately possible, stop and disable the PBackupVSS service on affected endpoints until an upgrade is applied.
- Apply an application control policy (for example, Windows Defender Application Control or AppLocker) that denies execution of shadow.exe from any path outside the legitimate Empirum installation directory.
- Remove write permissions on directories that unprivileged users can influence and that may be used as a working directory for the service.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
