CVE-2026-57919: Matrix42 Empirum Privilege Escalation via Named Pipe DACL Weakness

Technical summary

CVE-2026-57919 is a local privilege escalation vulnerability in Matrix42 Empirum versions before 25.5 and 26.x before 26.2. The PBackupVSS.exe process creates a named pipe at \\.\pipe\PBackupVSS with a DACL permitting GENERIC_READ and GENERIC_WRITE access to all authenticated users (CWE-276: Incorrect Default Permissions). A low-privileged attacker can connect to this pipe and transmit specially crafted inter-process communication (IPC) messages that trigger command execution with SYSTEM context. Exploitation leverages an insecure search path (CWE-426: Untrusted Search Path) by placing a malicious shadow.exe in a controlled working directory, which the process loads and executes with elevated privileges.

Business impact

Successful exploitation allows an insider or local attacker to bypass access controls and gain full administrative control over affected systems. This enables data theft, malware installation, system manipulation, and lateral movement to other networked resources. Organizations running Empirum for backup and disaster recovery face operational disruption, data loss, and compliance violations if the system is compromised. The vulnerability is particularly concerning in environments where Empirum manages critical infrastructure or sensitive backup operations.

Affected systems

Matrix42 Empirum versions before 25.5 and all 26.x versions before 26.2 are vulnerable. Any deployment of these versions with PBackupVSS.exe running (typically as a service with SYSTEM privileges) presents an exposure. The vulnerability requires local system access; remote exploitation is not possible. Systems with multi-user access, shared workstations, or containers running Empirum are at higher risk.

Exploitability

Exploitation requires local access and low privileges—realistic for disgruntled employees, contractors, or attackers who have compromised a user account. No special tools or advanced techniques are required; a standard user account and the ability to write files to a directory that the backup process searches constitute sufficient capability. The CVSS 3.1 score of 7.8 (HIGH) reflects these conditions: low attack complexity, no user interaction needed, and complete impact across confidentiality, integrity, and availability.

Remediation

Upgrade Matrix42 Empirum to version 25.5 or later for the 25.x branch, or to version 26.2 or later for the 26.x branch. Organizations unable to patch immediately should restrict local system access to trusted users only, use OS-level privilege separation where available, and monitor named pipe access for suspicious activity. Verify that PBackupVSS.exe is running with minimal necessary privileges and confirm that shadow.exe and other dependent binaries are loaded from secure, protected directories only.

Patch guidance

Consult the Matrix42 advisory for exact patched versions and deployment steps. Generally, update to 25.5+ or 26.2+, test the upgrade in a non-production environment first, and ensure backup processes remain functional after patching. Coordinate with backup and disaster recovery teams to minimize downtime. Verify that the named pipe permissions and search path behavior have been corrected post-patch.

Detection guidance

Monitor for unexpected connections to the \\.\pipe\PBackupVSS named pipe from unprivileged processes. Log and alert on creation or execution of shadow.exe outside of trusted Matrix42 installation directories. Review access control lists (ACLs) on the named pipe to confirm they have been restricted. Audit file system activity in directories that might be used as working directories for PBackupVSS.exe. Implement application whitelisting to prevent unauthorized execution of backup-related binaries.

Why prioritize this

Although KEV listing status does not currently flag this vulnerability and exploit code is not yet weaponized, the combination of local access, low complexity, and complete system compromise makes this HIGH priority. Any environment where non-administrative users share system access or where Empirum runs services accessible from compromised user accounts should patch urgently. Organizations relying on Empirum for backup integrity should treat this as critical to remediate.

Risk score, explained

The CVSS 3.1 score of 7.8 is justified by: (1) low attack complexity and low privilege requirements (exploitable by any authenticated user), (2) no user interaction required, (3) complete confidentiality, integrity, and availability impact once exploited, and (4) scope unchanged (impact limited to the single affected asset, though that asset is a high-value backup system). The score does not account for the insider threat context or the critical nature of backup systems in many environments, both of which should elevate organizational risk perception.

Frequently asked questions