A local user can gain elevated SYSTEM rights by connecting to a misconfigured named pipe that the Empirum PBackupVSS executable creates. The pipe allows arbitrary IPC messages, and the program ignores an untrusted search path. An attacker can place a malicious shadow.exe in a directory that the service will search, causing that code to run as SYSTEM. The weakness is an improper access control flaw that permits privilege escalation.

Matrix42 Empirum before version 25.5 and all 26.x releases before 26.2 are affected. Any installation that utilizes the PBackupVSS component is vulnerable.

The CVSS score of 7.8 indicates a high severity potential. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. A local, low‑privileged attacker can exploit the flaw with no special user privileges beyond being authenticated on the system. The attack vector is local and requires interaction with the named pipe, making it moderately likely to be discovered and used in targeted environments.