Duplicati
Monthly
Let me synthesize this. CVE-2026-76159: Duplicati for Windows before v2.4.0.0, incorrect permission assignment (CWE-732) in configuration loader, allows local low-priv attacker to escalate to SYSTEM via attacker-controlled preload.json. Product name: Duplicati. Tags include "Microsoft" which is likely a mislabeled tag — Duplicati is an independent open-source project (duplicati.com), not Microsoft. Though it runs on Windows... The tag "Microsoft" as vendor is wrong. Emit mislabeled_tag with target "Microsoft". Confidence high? Duplicati is an independent open-source backup tool, not Microsoft. Yes, high confidence. Missing tags? Maybe "windows" — since it's Windows-specific. Hmm, missing_tag target "Windows", suggested "windows". That's unambiguously implied ("Duplicati for Windows", MSI installers). Could emit. But careful — is "windows" a valid tag slug in their taxonomy? They said emit only when unambiguously implied. I'll include it with high confidence... Actually risk: their taxonomy may be "Microsoft Windows". Hmm. I'll include it maybe. Let's be a bit conservative but it seems clearly applicable. I'll include "windows" for missing_tag. Hmm, but if the slug doesn't exist it might attach a bad tag. The instructions say suggested is "lowercase hyphenated slug (e.g. target "WordPress", suggested "wordpress")". So "windows" is fine. Also "privilege-escalation" technique tag is already present as "Privilege Escalation". Fine. CVSS given is 4.0 base with E:X etc. Score 7.0. PR:L, AV:L, UI:P. Hmm, why UI:P? Probably because attacker needs to force the app to load the config... The preload.json is attacker-controlled — likely attacker with write access to a directory that gets loaded. Local low-priv attacker writes preload.json, then triggers service restart (UI:P passive — waiting for service restart/admin action). Anyway. My assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:P? Hmm, UI:P isn't valid in 3.1. UI options: N, R. If user interaction required (someone must rest
Local privilege escalation in Duplicati v2.3.0.1 allows an authenticated standard user to replace DLLs in the service directory when the software is installed outside the default Program Files path. On service restart, the Windows service loads the attacker-controlled DLL, granting arbitrary code execution as SYSTEM. No active exploitation is reported, and EPSS probability is low at 0.18%.
Let me synthesize this. CVE-2026-76159: Duplicati for Windows before v2.4.0.0, incorrect permission assignment (CWE-732) in configuration loader, allows local low-priv attacker to escalate to SYSTEM via attacker-controlled preload.json. Product name: Duplicati. Tags include "Microsoft" which is likely a mislabeled tag — Duplicati is an independent open-source project (duplicati.com), not Microsoft. Though it runs on Windows... The tag "Microsoft" as vendor is wrong. Emit mislabeled_tag with target "Microsoft". Confidence high? Duplicati is an independent open-source backup tool, not Microsoft. Yes, high confidence. Missing tags? Maybe "windows" — since it's Windows-specific. Hmm, missing_tag target "Windows", suggested "windows". That's unambiguously implied ("Duplicati for Windows", MSI installers). Could emit. But careful — is "windows" a valid tag slug in their taxonomy? They said emit only when unambiguously implied. I'll include it with high confidence... Actually risk: their taxonomy may be "Microsoft Windows". Hmm. I'll include it maybe. Let's be a bit conservative but it seems clearly applicable. I'll include "windows" for missing_tag. Hmm, but if the slug doesn't exist it might attach a bad tag. The instructions say suggested is "lowercase hyphenated slug (e.g. target "WordPress", suggested "wordpress")". So "windows" is fine. Also "privilege-escalation" technique tag is already present as "Privilege Escalation". Fine. CVSS given is 4.0 base with E:X etc. Score 7.0. PR:L, AV:L, UI:P. Hmm, why UI:P? Probably because attacker needs to force the app to load the config... The preload.json is attacker-controlled — likely attacker with write access to a directory that gets loaded. Local low-priv attacker writes preload.json, then triggers service restart (UI:P passive — waiting for service restart/admin action). Anyway. My assessed CVSS 3.1: AV:L/AC:L/PR:L/UI:P? Hmm, UI:P isn't valid in 3.1. UI options: N, R. If user interaction required (someone must rest
Local privilege escalation in Duplicati v2.3.0.1 allows an authenticated standard user to replace DLLs in the service directory when the software is installed outside the default Program Files path. On service restart, the Windows service loads the attacker-controlled DLL, granting arbitrary code execution as SYSTEM. No active exploitation is reported, and EPSS probability is low at 0.18%.