CVE-2026-16157Disclosure

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write to. A standard local user can overwrite any DLL in the service directory. On service restart, the OS loads the attacker's DLL before any managed code runs, executing arbitrary code as SYSTEM.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-732

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://news.ojobit.com/story/duplicati-backup-bug-local-system-dll-hijack-77a4cb

Full discourse1 post

OJOBIT@0J0BIT91d
Disclosure
Duplicati v2.3.0.1, a free open-source backup tool for Windows, ships as an MSI > Installing Duplicati v2.3.0.1 outside C: Files leaves the directory writable by standard users, enabling DLL planting that escalates to NT AUTHORITY on service restart > CVE-2026-16157 affects Duplicati v2.3.0.1 > no exploit in the wild-yet-but the advisory from CERT/CC (VU#847406) leaves nothing to the imagination: CVE-2026-16157 is a straightforward, unforced error in the MSI > default installation goes to C: Files 2\-a protected directory inheriting standard ACLs > the timeline: public disclosure on July 22, 2026-so expect proof-of-concept code to follow quickly > a local attacker can drop a malicious DLL into the installation directory; on service restart, Windows loads it before managed code runs-giving SYSTEM privileges https://news.ojobit.com/story/duplicati-backup-bug-local-system-dll-hijack-77a4cb
Post summary
The post outlines the technical details of CVE-2026-16157 in Duplicati v2.3.0.1 and its disclosure timeline, but does not provide a PoC, exploit, or patch.
0000073
8 followersView on X

Explore more

Back to dashboard