MSP360 Free Backup CVE-2025-12838
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged code execution on host
-
ExploitCreate junction targeting privileged path
-
ExecutionAdmin triggers restore, service follows link
-
ImpactArbitrary file written and executed as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Exploitation requires three concrete prerequisites: (1) the attacker must already be able to run low-privileged code on the target Windows host where MSP360 Free Backup is installed; (2) the attacker must create a filesystem junction that the backup service's restore functionality will follow (CWE-59); and (3) an administrator must perform a restore operation (UI:R), which is the event that causes the privileged service to create the attacker-controlled file as SYSTEM. The key limiting factors are the need for prior local foothold (PR:L, AV:L - not remotely reachable) and the mandatory administrator interaction, which prevents fully autonomous or unattended exploitation. |
| Impact | This is a moderate, locally-exploitable privilege escalation (CVSS 7.3) rather than a top-tier emergency. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:R) confirms a local, low-complexity flaw that requires the attacker to already have low-privileged code execution AND requires an administrator to perform a restore operation (UI:R) - two meaningful gating conditions that lower real-world likelihood. The impact is severe once chained (C:H/I:H/A:H, full SYSTEM code execution via CWE-59 link following). Exploitation signals are weak-to-absent: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced - only the ZDI advisory. These signals are mutually consistent (low EPSS, no KEV, no POC all point the same direction), so there is no conflict to flag. Net: a credible local EoP worth patching on normal cycles, but not evidence of active or imminent widespread exploitation. The main caveat is the required administrator interaction, which makes opportunistic mass exploitation unlikely and favors targeted or social-engineering-assisted scenarios. |
| Exploit ScenarioDerived | A low-privileged user on a Windows host running MSP360 Free Backup plants a filesystem junction so that when the backup service's restore functionality runs, it follows the link and writes an attacker-controlled file to a privileged location. When an administrator is induced to perform a restore (the required UI:R interaction), the service creates the arbitrary file as SYSTEM, giving the attacker code execution as SYSTEM. No public proof-of-concept is referenced beyond the ZDI advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Local privilege escalation in MSP360 Free Backup (CVSS 7.3) lets an attacker who already has low-privileged code execution create a filesystem junction that the restore function follows, causing arbitrary files to be created with SYSTEM privileges when an administrator initiates a restore, potentially leading to code execution as SYSTEM. Exploitation requires local access, a pre-existing foothold, and administrator interaction; EPSS is low at 0.18% (7th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis.
RemediationAI
No vendor-released patch or fixed version is identified in the available data; monitor MSP360 and ZDI-25-988 (https://www.zerodayinitiative.com/advisories/ZDI-25-988/) for an update. Until a fix is available, reduce exposure by preventing the prerequisite low-privileged code execution with application allowlisting and endpoint hardening, limiting interactive logon to trusted users, and removing unnecessary local accounts. Restrict and audit creation of junctions or reparse points in paths used by the backup restore service, for example by tightening SeCreateSymbolicLinkPrivilege, accepting that this can break legitimate developer or backup workflows that rely on links. Require restore operations to be initiated only by trusted administrators after verifying the destination path, monitor the service for file creation in unexpected locations, and, if operationally feasible, run the backup service under a less privileged account rather than SYSTEM with testing to avoid breaking restore functionality.
Affected ProductsAI
MSP360 Free Backup on Windows installations are affected; the provided data does not specify an exact version range or CPE strings. The description refers to affected installations of MSP360 Free Backup, and the ZDI advisory ZDI-25-988 (https://www.zerodayinitiative.com/advisories/ZDI-25-988/) is the available reference.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-59, Improper Link Resolution Before File Access ('Link Following'), in the restore functionality of MSP360 Free Backup. On Windows, an attacker can create a junction or reparse point in a path used by the privileged backup service; when an administrator triggers a restore, the service follows the link and writes attacker-chosen files in a SYSTEM context. The CVSS vector is AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H: local attack, low privileges required, user interaction required, and high confidentiality/integrity impact. No CPE strings or exact version range were supplied, and the only reference is ZDI-25-988; the flaw was reported as ZDI-CAN-27245.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local foothold required (AV:L/PR:L), junction creation is straightforward (AC:L), admin must trigger the restore (UI:R), and SYSTEM code execution yields full C/I/A:H.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSP360 Free Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is needed additionally.
The specific flaw exists within the restore functionality. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27245.
Executive ViewAI
MSP360 Free Backup contains a high-severity local privilege-escalation flaw that could let an attacker with an existing low-privileged foothold gain SYSTEM-level control when an administrator performs a restore. The organizational risk is concentrated on systems running the product and on backup/restore workflows, so leadership should prioritize inventory, access restriction, and monitoring while no vendor fix is available. No public exploit identified at time of analysis, and exploitation requires local access plus administrator interaction.
No vendor patch is available; restrict local access and restore initiation to trusted administrators, remove or isolate MSP360 Free Backup where not required, enforce least privilege and application allowlisting, monitor restore operations and junction/symlink creation, and maintain backups of critical data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
GitHub PoC
Exploit-DB