CVE-2026-4824

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4824", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-25T13:56:41.862Z", "datePublished": "2026-03-25T21:44:35.374Z", "dateUpdated": "2026-03-26T15:03:00.913Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-25T21:44:35.374Z"}, "title": "Enter Software Iperius Backup Backup Job Configuration File privileges management", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "Improper Privilege Management"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "Enter Software", "product": "Iperius Backup", "versions": [{"version": "8.7.0", "status": "affected"}, {"version": "8.7.1", "status": "affected"}, {"version": "8.7.2", "status": "affected"}, {"version": "8.7.3", "status": "affected"}, {"version": "8.7.4", "status": "unaffected"}], "modules": ["Backup Job Configuration File Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.3, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "baseSeverity": "HIGH"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6, "vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-25T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-25T15:01:51.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "0truust (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.353124", "name": "VDB-353124 | Enter Software Iperius Backup Backup Job Configuration File privileges management", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.353124", "name": "VDB-353124 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.774220", "name": "Submit #774220 | Enter Software Iperius Backup <= 8.7.2 Improper Privilege Management", "tags": ["third-party-advisory"]}, {"url": "https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/privilege-escalation-rce.md", "tags": ["exploit"]}, {"url": "https://www.iperiusbackup.com/download-software-backup.aspx", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T14:52:09.049409Z", "id": "CVE-2026-4824", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T15:03:00.913Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4824", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-26T14:52:09.049409Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T15:00:05.510Z"}}], "cna": {"title": "Enter Software Iperius Backup Backup Job Configuration File privileges management", "credits": [{"lang": "en", "type": "reporter", "value": "0truust (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6, "vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "Enter Software", "modules": ["Backup Job Configuration File Handler"], "product": "Iperius Backup", "versions": [{"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.2"}, {"status": "affected", "version": "8.7.3"}, {"status": "unaffected", "version": "8.7.4"}]}], "timeline": [{"lang": "en", "time": "2026-03-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-25T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-25T15:01:51.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.353124", "name": "VDB-353124 | Enter Software Iperius Backup Backup Job Configuration File privileges management", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.353124", "name": "VDB-353124 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.774220", "name": "Submit #774220 | Enter Software Iperius Backup <= 8.7.2 Improper Privilege Management", "tags": ["third-party-advisory"]}, {"url": "https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/privilege-escalation-rce.md", "tags": ["exploit"]}, {"url": "https://www.iperiusbackup.com/download-software-backup.aspx", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-25T21:44:35.374Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4824", "state": "PUBLISHED", "dateUpdated": "2026-03-26T15:03:00.913Z", "dateReserved": "2026-03-25T13:56:41.862Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-25T21:44:35.374Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Backup Job Configuration File Handler"], "product": "Iperius Backup", "vendor": "Enter Software", "versions": [{"status": "affected", "version": "8.7.0"}, {"status": "affected", "version": "8.7.1"}, {"status": "affected", "version": "8.7.2"}, {"status": "affected", "version": "8.7.3"}, {"status": "unaffected", "version": "8.7.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en Enter Software Iperius Backup hasta la versi\u00f3n 8.7.3. Afectada por este problema est\u00e1 alguna funcionalidad desconocida del componente Gestor de Archivos de Configuraci\u00f3n de Tareas de Copia de Seguridad. La manipulaci\u00f3n conduce a una gesti\u00f3n de privilegios inadecuada. El ataque debe ser llevado a cabo localmente. Se considera que el ataque tiene una complejidad alta. Se sabe que la explotaci\u00f3n es dif\u00edcil. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. Actualizar a la versi\u00f3n 8.7.4 puede resolver este problema. Es aconsejable actualizar el componente afectado. El proveedor fue contactado tempranamente, respondi\u00f3 de una manera muy profesional y r\u00e1pidamente lanz\u00f3 una versi\u00f3n corregida del producto afectado."}], "id": "CVE-2026-4824", "lastModified": "2026-06-17T10:57:17.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 6.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4824", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T14:52:09.049409Z", "version": "2.0.3"}}]}, "published": "2026-03-25T22:16:19.497", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/privilege-escalation-rce.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.353124"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.353124"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.774220"}, {"source": "cna@vuldb.com", "url": "https://www.iperiusbackup.com/download-software-backup.aspx"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-269"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "8.7.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "8.7.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Iperius Backup", "source": "cna", "vendor": "Enter Software"}, "product": "iperius_backup", "vendor": "enter_software"}], "analysis": {"en": {"generated_at": "2026-03-26T03:15:59.506915+00:00", "value": {"mitigation_remediation": ["Upgrade Iperius Backup to version 8.7.4 or newer to apply the vendor\u2019s fix for the privilege\u2011management flaw."], "summary": {"action": "Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Enter Software Iperius Backup versions up to and including 8.7.3 are affected. Users running these releases should verify the exact build and consider applying the update to 8.7.4 as released by the vendor. ", "description_and_impact": "The vulnerability arises from improper privilege management in the Backup Job Configuration File Handler component of Iperius Backup. Manipulation of this handler enables a local attacker to obtain elevated privileges within the application, potentially leading to unauthorized control over backup operations and sensitive data. The weakness is associated with CWE-266 and CWE-269, indicating flawed privileged access management. ", "risk_and_exploitability": "The CVSS base score of 7.3 indicates a high severity, and the attack requires local access with high complexity, making exploitation nontrivial. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the combination of high severity and confirmed public disclosure suggests that organizations should treat it as a significant risk pending patch deployment."}}}}, "created": "2026-03-26T11:31:23.448691+00:00", "updated": "2026-03-26T12:09:26.730749+00:00", "vendors": ["enter_software", "enter_software$PRODUCT$iperius_backup"]}