Privilege Escalation in Duplicati for Windows by Vendors
CVE-2026-76159

7HIGH

Key Information:

Vendor

Duplicati

Status
Duplicati
Vendor
CVE Published:
15 September 2026

What is CVE-2026-76159?

A security vulnerability in the configuration loader of Duplicati for Windows versions prior to 2.4.0.0 allows local low-privileged attackers to escalate their privileges. By manipulating an attacker-controlled preload.json file, these attackers can gain unauthorized access to critical system resources, potentially compromising system integrity and security.

Affected Version(s)

Duplicati Windows 0

References

https://zuso.ai/advisory/
third-party-advisory

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.