Vulnerability Description
Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-76159?
CVE-2026-76159 is a documented vulnerability. Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges...
How severe is CVE-2026-76159?
CVSS scoring is not yet available for CVE-2026-76159. Check NVD for updates.
Is there a patch for CVE-2026-76159?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.