CVE-2026-57919

Name of the Vulnerable Software and Affected Versions Matrix42 Empirum versions prior to 25.5 Matrix42 Empirum versions 26.x prior to 26.2

Description The PBackupVSS.exe component creates a named pipe at '.pipePBackupVSS' with a Discretionary Access Control List (DACL) that grants GENERIC READ and GENERIC WRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted Inter-Process Communication (IPC) messages to trigger the execution of arbitrary commands with SYSTEM privileges. This is achieved via an untrusted search path, allowing the attacker to escalate privileges by placing a malicious shadow.exe file in a controlled working directory.

Recommendations Update Matrix42 Empirum to version 25.5 or later. Update Matrix42 Empirum version 26.x to version 26.2 or later.