EUVD-2026-16005
GHSA-qj4q-79hc-9854
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents minimal real-world risk despite being publicly disclosed. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates strictly local attack vector with high complexity, requiring low-privilege authentication, making opportunistic exploitation unlikely. The EPSS score of P/E:P (published exploit exists) suggests theoretical exploitability, but the combination of local-only access, high complexity, and requirement for authenticated user status significantly constrains real-world impact. SSVC analysis favors low urgency: exploitation requires local access and elevated complexity, technical impact is limited to confidentiality (single system, low scope), and automatable exploitation is improbable. The availability of a vendor patch within normal timelines (8.7.4) and professional vendor responsiveness further reduce risk. Organizations should prioritize other vulnerabilities with lower attack complexity or higher impact potential. |
| Exploit ScenarioDerived | An authenticated local user with limited privileges (non-administrator) on a system running Iperius Backup 8.7.3 manipulates the NTLM2 authentication handler—potentially through crafted backup job configurations or direct interaction with backup processes—to trigger credential exposure or NTLM relay scenarios. By exploiting the high-complexity attack path, the attacker extracts cached or in-transit NTLM credentials or session tokens, gaining visibility into backup authentication material. While the published GitHub proof-of-concept (https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/ntlm-relay-credential-exposure.md) demonstrates feasibility, successful exploitation requires deep system knowledge and careful manipulation, making this a threat primarily to insiders or highly motivated adversaries with local access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A local information disclosure vulnerability exists in Enter Software Iperius Backup versions up to 8.7.3 within the NTLM2 Handler component, allowing authenticated local users to extract sensitive information through a complex manipulation attack. The vulnerability carries a CVSS score of 2.5 with low exploitability due to high attack complexity requirements, though a proof-of-concept has been publicly disclosed on GitHub. Upgrading to version 8.7.4 or later completely resolves this issue, and the vendor responded professionally with a timely patch release.
RemediationAI
Immediately upgrade Enter Software Iperius Backup to version 8.7.4 or later, which contains the vendor's fix for the NTLM2 Handler information disclosure flaw. Download the patched version from https://www.iperiusbackup.com/download-software-backup.aspx and apply it to all affected systems. Prior to patching, limit local system access to only trusted administrative users and disable unnecessary backup services that may expose the NTLM2 Handler functionality. Additionally, audit local user accounts and enforce strong authentication policies to minimize the window of exposure for any unauthenticated local users. For environments unable to patch immediately, restrict backup software to internal networks only and implement local firewall rules to prevent lateral movement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the NTLM2 (NT LAN Manager version 2) authentication handler component of Iperius Backup, a backup and disaster recovery solution (cpe:2.3:a:enter_software:iperius_backup). NTLM2 is a legacy Windows authentication protocol used for credential negotiation and session establishment. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating improper handling or exposure of credentials or authentication material during NTLM2 processing. The flaw allows local attackers with limited privileges to potentially extract or relay NTLM credentials through manipulation of the authentication handler, likely exploiting weaknesses in credential storage, session management, or challenge-response handling within the backup software's authentication layer.
Know when Iperius Backup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. Attacks of this nature are highly complex. The exploitation appears to be difficult. The exploit has been published and may be used. Upgrading to version 8.7.4 addresses this issue. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Executive ViewAI
CVE-2026-4823 is a low-severity vulnerability in Enter Software Iperius Backup involving information exposure (CVSS 2.0). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.
Apply vendor patch during routine maintenance. Standard information disclosure mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Iperius Backup
View allIperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism
Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary
Iperius Backup 8.7.3 creates temporary files with insecure permissions in the Backup Service component, allowing local a
Improper privilege management in Iperius Backup through version 8.7.3 allows local authenticated attackers to escalate p
Iperius Backup versions up to 8.7.2 use a hard-coded cryptographic key for IperiusAccounts.ini file encryption, allowing
Exploit-DB