PT-2026-7916 · Intego · Intego Personal Backup

Mathieu Farrell · Publicado 2026-02-12 · Atualizado 2026-02-12 · CVE-2026-26225

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Intego Personal Backup (affected versions not specified)

Description Intego Personal Backup, a macOS backup utility, has a local privilege escalation issue. Backup task definitions are stored in a writable location for non-privileged users but are processed with elevated privileges. A local attacker can exploit this by creating a malicious serialized task file to trigger arbitrary file writes to sensitive system locations, potentially gaining root access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2026-26225

Produtos afetados

Intego Personal Backup

Referências · 7

• 🔥 https://blog.quarkslab.com/intego_lpe_macos_1.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26225 · Nota de Segurança
• https://vulncheck.com/advisories/intego-personal-backup-task-file-privilege-escalation · Nota
• https://integosupport.zendesk.com/hc/en-us/articles/40945636077467-Personal-Backup-X9-Release-Notes · Nota
• https://intego.com/bootable-mac-backups · Nota
• https://intego.com · Nota
• https://twitter.com/CVEnew/status/2022081027531776379 · Publicação no Twitter