---
id: CVE-2026-57919
title: >-
  PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a
  named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and
  GENERIC_WRITE permissions to all authenticated users
summary: >-
  PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a
  named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and
  GENERIC_WRITE permissions to all authenticated users. A low-privileged local
  attacker…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-276
  - CWE-426
published: '2026-06-29'
updated: '2026-07-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57919'
references:
  - url: >-
      https://docs.matrix42.com/1041748_vulnerability-list/3862631_cve-2026-57919-privilege-escalation-in-empirum-personal-backup/
    label: cve@mitre.org
  - url: >-
      https://docs.matrix42.com/en_US/1041748_vulnerability-list/cve-2026-57919-privilege-escalation-in-empirum-personal-backup
    label: cve@mitre.org
  - url: 'https://matrix42.com'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00177
epssPercentile: 0.06499
ingestedAt: '2026-07-17T17:13:26.746Z'
---

## Overview

PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted IPC messages to trigger execution of arbitrary commands with SYSTEM privileges via an untrusted search path. This allows privilege escalation by placing a malicious shadow.exe in a controlled working directory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.