Duplicati DLL Hijack Flaw Enables SYSTEM Access
Duplicati v2.3.0.1 lets local attackers escalate to SYSTEM via DLL hijacking when installed outside the default Program Files directory.
CERT/CC disclosed CVE-2026-16157, a privilege escalation vulnerability in Duplicati v2.3.0.1, an open-source backup tool for Windows. The flaw stems from the MSI installer's failure to apply protective ACLs when Duplicati is installed to a non-default directory. Duplicati registers a LocalSystem service that loads binaries from its installation folder, and if that folder lacks the standard Program Files protections, any local standard user with write access can drop a malicious DLL that the SYSTEM service will load on restart.
Exploitation requires local access and a non-default installation path, limiting the attack surface to systems where administrators deviated from default deployment guidance. However, successful exploitation grants an attacker NT AUTHORITY\SYSTEM privileges, a significant escalation from standard user rights. CERT/CC attributes discovery to researcher Valton Tahiri and recommends installing Duplicati under the default C:\Program Files\Duplicati 2\ path or manually applying equivalent ACL protections to alternate installation directories, alongside applying vendor patches.
No evidence of active exploitation is noted in the advisory; this is a responsibly disclosed vulnerability with a straightforward mitigation path (default install location or matching ACLs).
Mentioned in this report
Detection guidance
DLL Dropped in Non-Default Duplicati Install Directory
Detects a DLL being written into a Duplicati installation folder that is not the protected default Program Files path, the precondition for the SYSTEM service DLL side-loading hijack described in CVE-2026-16157. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: DLL Dropped in Non-Default Duplicati Install Directory
description: Detects creation of a .dll file inside a folder containing 'Duplicati'
that is not the default C:\Program Files\Duplicati 2\ path. On non-default installs
this folder lacks Program Files ACL protections, allowing a standard user to plant
a DLL that the LocalSystem Duplicati service will load on restart (CVE-2026-16157).
tags:
- attack.privilege_escalation
- attack.persistence
- attack.t1574.002
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: \Duplicati
TargetFilename|endswith: .dll
filter_default_path:
TargetFilename|contains: \Program Files\Duplicati 2\
filter_system_writer:
User|contains:
- NT AUTHORITY\SYSTEM
- TrustedInstaller
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate Duplicati updates or plugin DLLs deployed by an administrator to a custom
install path
- Backup/config management tooling that redeploys Duplicati binaries outside Program
Files
level: high
id: bac6fa8f-0a67-5720-8354-11934805447b
status: experimental
author: Vorant
Duplicati Service Process Loading DLL from Non-Protected Directory
Detects the Duplicati SYSTEM service loading a DLL image from a location outside the default, ACL-protected Program Files installation path, consistent with successful DLL hijack exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Duplicati Service Process Loading DLL from Non-Protected Directory
description: Detects a Duplicati service executable (running as SYSTEM) loading a
DLL from a path other than the default protected C:\Program Files\Duplicati 2\ directory.
This matches successful exploitation of CVE-2026-16157 where an attacker-planted
DLL in a writable, non-default install folder is loaded by the privileged service.
tags:
- attack.privilege_escalation
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
Image|contains: Duplicati
Image|endswith:
- Server.exe
- Service.exe
ImageLoaded|endswith: .dll
filter_default_path:
ImageLoaded|contains: \Program Files\Duplicati 2\
filter_windows_system_dll:
ImageLoaded|contains:
- \Windows\System32\
- \Windows\WinSxS\
condition: selection and not 1 of filter_*
falsepositives:
- Duplicati installed intentionally to a custom directory with correctly applied equivalent
ACLs and legitimate plugin DLLs present
- Third-party antivirus or backup agent hooks injecting modules into the Duplicati
process
level: high
id: 077568b8-c66b-564f-a865-ea00b9c688a2
status: experimental
author: Vorant
SYSTEM Process Spawned from Non-Default Duplicati Install Path
Detects a process running as SYSTEM being launched from a Duplicati installation directory outside the default Program Files path, indicating the vulnerable service is running from an unprotected location where hijack is possible. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SYSTEM Process Spawned from Non-Default Duplicati Install Path
description: Detects process creation where the image path contains 'Duplicati' but
is not under the default protected Program Files install location and the process
token is SYSTEM. This highlights the vulnerable configuration exploited in CVE-2026-16157
and can also catch execution of a hijacked payload if the child process itself is
the attacker DLL's spawned executable.
tags:
- attack.privilege_escalation
- attack.t1574.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains: \Duplicati
User|contains: NT AUTHORITY\SYSTEM
filter_default_path:
Image|contains: \Program Files\Duplicati 2\
condition: selection and not filter_default_path
falsepositives:
- Administrators who intentionally installed Duplicati to a custom path but applied
correct restrictive ACLs matching Program Files defaults
- Backup automation scripts that relocate and relaunch the Duplicati service binary
during maintenance
level: medium
id: f045a9af-4003-5cf5-8adf-7cc6e906e6e3
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/847406
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free