CVE-2026-76159

HighCVSS 7.0

Published: 15/09/2026(UTC)Updated: 16/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file. It requires local access to the machine.

Risk Assessment

A local low-privileged attacker can gain NT AUTHORITY\SYSTEM privileges, leading to full system compromise. It requires local access to the machine.

Recommendation

Upgrade Duplicati for Windows to version v2.4.0.0 or later. Until then, restrict local access to machines running Duplicati.

Other vulnerabilities in Duplicati

CVE-2026-16157High
Duplicati v2.3.0.1 grants Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing outside Program Files or on a custom path creates a LocalSystem service running from a writable directory. A standard local user can overwrite any DLL in the service directory, leading to arbitrary code execution as SYSTEM on service restart.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS