Matrix42 Empirum CVE-2026-57919

Exploitation requires an interactive or local authenticated session on a Windows host where Matrix42 Empirum's Personal Backup component (PBackupVSS.exe) is installed and running - any member of the Authenticated Users group qualifies, because the named pipe \\.\pipe\PBackupVSS is created with a DACL granting GENERIC_READ/GENERIC_WRITE to all authenticated users. The attacker must be able to write a malicious shadow.exe into a working directory that the service's untrusted search path resolves, then send crafted IPC messages over the pipe. Limiting factors: this is local-only (AV:L) - no remote/network exploitation is possible; the attacker needs an existing low-privileged account (PR:L), so it is a post-foothold escalation rather than initial access; and the vulnerable PBackupVSS service must be present and active, so hosts without the Personal Backup feature are not exposed.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local vector, low complexity, low privileges, no user interaction, and full confidentiality/integrity/availability impact, which is a textbook local-to-SYSTEM escalation profile. The signals are internally consistent: this is genuinely exploitable but requires the attacker to already have a foothold (any authenticated local account), so it is a second-stage/post-compromise primitive rather than a remote entry point. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active or automatable exploitation; treat the 7.8 as the dominant signal. Real-world priority is moderate-to-high specifically on hosts where Empirum is deployed and where untrusted users have interactive/local access, but low where only trusted admins log in. Note the limitation: with no EPSS or exploitation-status data, the urgency relative to other patches cannot be ranked from threat-intel signals alone - prioritize based on patch availability and exposure.

An attacker who has obtained any low-privileged authenticated account on an Empirum-managed Windows host (e.g., a phished standard user or a compromised service account) plants a malicious shadow.exe in a working directory the service will search. They then connect to the \\.\pipe\PBackupVSS named pipe and send crafted IPC messages that cause the SYSTEM-running PBackupVSS.exe to execute that binary, yielding SYSTEM-level code execution. No public exploit code is identified, but the local attack complexity is low and requires no user interaction.