CVE-2026-4823 identifies an information disclosure vulnerability in Enter Software's Iperius Backup product, specifically affecting versions 8.7.0 through 8.7.3. The vulnerability resides in an unspecified functionality within the NTLM2 Handler component, which is responsible for handling NTLM authentication processes. An attacker with local access and low privileges can manipulate this component to cause information disclosure. The exact nature of the leaked information is not detailed, but the impact is limited to confidentiality with no reported integrity or availability effects. Exploitation complexity is high, requiring local access and advanced knowledge, and no user interaction is necessary. The vulnerability has a CVSS 4.0 base score of 2.0, reflecting its low severity due to restricted attack vector (local), high attack complexity, and limited impact. The vendor responded promptly and released version 8.7.4 to remediate the flaw. No known active exploits have been reported in the wild, but a proof-of-concept exploit has been published, indicating potential future risk if systems remain unpatched.

The primary impact of CVE-2026-4823 is limited information disclosure, which could potentially expose sensitive data handled by the NTLM2 Handler component within Iperius Backup. Although the vulnerability requires local access and is complex to exploit, an attacker who successfully leverages this flaw could gain insights into system or authentication details that might aid in further attacks or lateral movement within a network. However, the low CVSS score and absence of integrity or availability impacts suggest that the overall risk to organizations is minimal if the vulnerability is promptly addressed. The threat is mainly relevant in environments where attackers have already compromised user-level access, such as insider threats or post-exploitation scenarios. Organizations relying on Iperius Backup for critical backup operations should consider the potential confidentiality risks, especially if backup data or authentication credentials could be exposed.

To mitigate CVE-2026-4823, organizations should immediately upgrade Iperius Backup to version 8.7.4 or later, as this version contains the vendor's fix for the vulnerability. Since the attack requires local access with low privileges, enforcing strict access controls and limiting user permissions on systems running Iperius Backup can reduce the attack surface. Employing endpoint protection and monitoring for unusual local activity can help detect potential exploitation attempts. Additionally, organizations should audit and restrict local user accounts to minimize the risk of unauthorized access. Regularly reviewing backup software configurations and applying vendor updates promptly is critical. Network segmentation to isolate backup servers and limiting administrative access further reduce exposure. Finally, educating users about the risks of local privilege misuse and maintaining robust incident response plans will enhance overall resilience.