EUVD-2026-16005
GHSA-qj4q-79hc-9854
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been published and may be used. Upgrading to version 8.7.4 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
A local information disclosure vulnerability exists in Enter Software Iperius Backup versions up to 8.7.3 within the NTLM2 Handler component, allowing authenticated local users to extract sensitive information through a complex manipulation attack. The vulnerability carries a CVSS score of 2.5 with low exploitability due to high attack complexity requirements, though a proof-of-concept has been publicly disclosed on GitHub. Upgrading to version 8.7.4 or later completely resolves this issue, and the vendor responded professionally with a timely patch release.
Technical ContextAI
The vulnerability resides in the NTLM2 (NT LAN Manager version 2) authentication handler component of Iperius Backup, a backup and disaster recovery solution (cpe:2.3:a:enter_software:iperius_backup). NTLM2 is a legacy Windows authentication protocol used for credential negotiation and session establishment. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper handling or exposure of credentials or authentication material during NTLM2 processing. The flaw allows local attackers with limited privileges to potentially extract or relay NTLM credentials through manipulation of the authentication handler, likely exploiting weaknesses in credential storage, session management, or challenge-response handling within the backup software's authentication layer.
RemediationAI
Immediately upgrade Enter Software Iperius Backup to version 8.7.4 or later, which contains the vendor's fix for the NTLM2 Handler information disclosure flaw. Download the patched version from https://www.iperiusbackup.com/download-software-backup.aspx and apply it to all affected systems. Prior to patching, limit local system access to only trusted administrative users and disable unnecessary backup services that may expose the NTLM2 Handler functionality. Additionally, audit local user accounts and enforce strong authentication policies to minimize the window of exposure for any unauthenticated local users. For environments unable to patch immediately, restrict backup software to internal networks only and implement local firewall rules to prevent lateral movement.
More in Iperius Backup
View allIperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism
Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary
Iperius Backup 8.7.3 creates temporary files with insecure permissions in the Backup Service component, allowing local a
Improper privilege management in Iperius Backup through version 8.7.3 allows local authenticated attackers to escalate p
Iperius Backup versions up to 8.7.2 use a hard-coded cryptographic key for IperiusAccounts.ini file encryption, allowing
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today