Description
A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Published: 2026-03-25
Score: 7.3 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Patch
AI Analysis

Impact

The vulnerability arises from improper privilege management in the Backup Job Configuration File Handler component of Iperius Backup. Manipulation of this handler enables a local attacker to obtain elevated privileges within the application, potentially leading to unauthorized control over backup operations and sensitive data. The weakness is associated with CWE-266 and CWE-269, indicating flawed privileged access management.

Affected Systems

Enter Software Iperius Backup versions up to and including 8.7.3 are affected. Users running these releases should verify the exact build and consider applying the update to 8.7.4 as released by the vendor.

Risk and Exploitability

The CVSS base score of 7.3 indicates a high severity, and the attack requires local access with high complexity, making exploitation nontrivial. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the combination of high severity and confirmed public disclosure suggests that organizations should treat it as a significant risk pending patch deployment.

Generated by OpenCVE AI on March 26, 2026 at 03:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Iperius Backup to version 8.7.4 or newer to apply the vendor’s fix for the privilege‑management flaw.

Generated by OpenCVE AI on March 26, 2026 at 03:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Enter Software
Enter Software iperius Backup
Vendors & Products Enter Software
Enter Software iperius Backup

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title Enter Software Iperius Backup Backup Job Configuration File privileges management
Weaknesses CWE-266
CWE-269
References
Metrics cvssV2_0

{'score': 6, 'vector': 'AV:L/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 7.3, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Enter Software Iperius Backup
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-26T15:03:00.913Z

Reserved: 2026-03-25T13:56:41.862Z

Link: CVE-2026-4824

cve-icon Vulnrichment

Updated: 2026-03-26T15:00:05.510Z

cve-icon NVD

Status : Deferred

Published: 2026-03-25T22:16:19.497

Modified: 2026-04-24T16:35:20.070

Link: CVE-2026-4824

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:09:26Z

Weaknesses