CVE-2026-112174

A local privilege escalation vulnerability in Iperius Backup 8.8.3 is caused by insufficient separation between the graphical user interface running with elevated privileges and low-privileged local users. When the backup service is configured to run persistently with Administrator privileges, a local low-privileged attacker can use the native Windows dialogs exposed by the application to run programs that inherit its elevated context.

A low-privileged attacker can execute commands as SYSTEM or Administrator, leading to full compromise of the Windows system. This poses a serious threat to workstations and servers running Iperius Backup.

Update Iperius Backup to a version later than 8.8.3 and restrict local access to machines running this application. Consider running the service with minimal required privileges instead of persistently with Administrator privileges.