CVE-2026-76159: Duplicati Privilege Escalation Vulnerability

CVE-2026-76159 Overview

CVE-2026-76159 is a local privilege escalation vulnerability in the configuration loader of Duplicati for Windows. Versions before v2.4.0.0 assign incorrect permissions to a critical resource, allowing a low-privileged local user to modify the preload.json configuration file. When Duplicati runs as a service, it loads this attacker-controlled file and executes with NT AUTHORITY\SYSTEM privileges. The weakness is categorized under [CWE-732] Incorrect Permission Assignment for Critical Resource.

Critical Impact
A local low-privileged attacker can escalate to NT AUTHORITY\SYSTEM by planting a malicious preload.json file that the Duplicati configuration loader reads at startup.

Affected Products

Duplicati for Windows versions prior to v2.4.0.0
Windows deployments running Duplicati as a service account
Windows systems where standard users can write to the Duplicati configuration path

Discovery Timeline

2026-09-15 - CVE-2026-76159 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-76159

Vulnerability Analysis

Duplicati is an open-source backup client that runs on Windows as a background service under a privileged account. During initialization, the configuration loader reads preload.json to determine runtime parameters. In versions prior to v2.4.0.0, the file or its containing directory is created with permissions that allow non-administrative users to modify its contents.

A local attacker with standard user rights can write attacker-controlled values into preload.json. When the Duplicati service starts, or when a privileged process reloads its configuration, the loader parses the tampered file. The injected values drive execution flow under the SYSTEM account, resulting in full local compromise.

Exploitation requires local access and user interaction, such as a service restart or scheduled task trigger. No network access is needed. Because the vulnerability abuses trusted configuration parsing, it bypasses application-layer authentication and standard User Account Control (UAC) prompts.

Root Cause

The root cause is Incorrect Permission Assignment for Critical Resource [CWE-732]. The installer or runtime creates preload.json with an access control list (ACL) that grants write access to BUILTIN\Users or an equivalent low-privileged group. The configuration loader trusts the file contents without validating the file owner, integrity, or ACL.

Attack Vector

The attack path proceeds as follows. A local attacker with a standard user account locates the writable preload.json. The attacker modifies the file to inject values processed by the loader. When the Duplicati service executes under SYSTEM and reads the file, the attacker's payload runs in the privileged context. See the Zuso Advisory Information for additional technical details.

Detection Methods for CVE-2026-76159

Indicators of Compromise

Unexpected modifications to preload.json in the Duplicati installation directory made by non-administrative accounts.
New child processes spawned by the Duplicati service running under NT AUTHORITY\SYSTEM that do not match legitimate backup operations.
ACL changes on Duplicati configuration files or directories performed by standard users.

Detection Strategies

Audit file system access on the Duplicati installation path and alert on writes to preload.json from non-administrative security identifiers (SIDs).
Correlate Duplicati service start events with subsequent process creation events to identify anomalous privileged child processes.
Baseline the expected ACLs on Duplicati configuration files and flag deviations from the known-good permission set.

Monitoring Recommendations

Enable Windows object access auditing (Event ID 4663) for the Duplicati configuration directory.
Track service restart events (Event ID 7036) for the Duplicati service and correlate with prior file modifications.
Monitor process lineage for Duplicati.WindowsService.exe and alert on unexpected descendants.

How to Mitigate CVE-2026-76159

Immediate Actions Required

Upgrade Duplicati for Windows to version v2.4.0.0 or later on all affected hosts.
Restrict write access on the Duplicati installation directory and preload.json to administrators and the service account only.
Review recent modifications to preload.json for signs of tampering and restore known-good configuration if changes are unattributed.

Patch Information

The vendor addressed the issue in Duplicati v2.4.0.0. The fix corrects the permission assignment on the configuration loader resources. Refer to the Zuso Advisory Information for advisory content and any linked vendor release notes.

Workarounds

Manually harden the ACL on preload.json and its parent directory to remove write permissions for BUILTIN\Users and other non-privileged principals.
Run Duplicati under a dedicated low-privileged service account instead of SYSTEM where operationally feasible.
Restrict interactive logon on servers hosting Duplicati to reduce the pool of potential local attackers.

bash

# Configuration example: restrict preload.json permissions using icacls
icacls "C:\Program Files\Duplicati 2\preload.json" /inheritance:r
icacls "C:\Program Files\Duplicati 2\preload.json" /grant:r "BUILTIN\Administrators:(F)" "NT AUTHORITY\SYSTEM:(F)"
icacls "C:\Program Files\Duplicati 2\preload.json" /remove "BUILTIN\Users"