PT-2026-2399 · Cobian · Cobian Backup

Hejap Zairy · Published 2026-01-13 · Updated 2026-03-02 · CVE-2022-50923

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cobian Backup version 0.9

Description A local user can execute arbitrary code with elevated system privileges. This is due to an unquoted service path in the CobianReflectorService, allowing attackers to inject malicious code that executes with LocalSystem permissions during service startup.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider modifying the service path to include quotes to prevent malicious code execution.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2022-50923

Affected Products

Cobian Backup

References · 9

• 🔥 https://exploit-db.com/exploits/50810 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50923 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50923 · Vendor Advisory
• https://t.me/cveNotify/153573 · Telegram Post
• https://twitter.com/CVEnew/status/2011759608944083420 · Twitter Post
• https://t.me/cveNotify/153749 · Telegram Post
• https://cobiansoft.com/download.php · Note
• https://vulncheck.com/advisories/cobian-backup-unquoted-service-path · Note
• https://cobiansoft.com · Note