Skip to main content

CISA Issues Guidance on Duplicati v2.3.0.1 Vulnerability CVE-2026-16157

Source Decision Insights Threat Desk Published August 23, 2026 Companies 2
Human View Machine View

2 companies named across 1 category, the first article referencing Duplicati.

Companies mentioned

Best suited for

Seniority
Director
Job function
Cybersecurity / Information Security
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Which to buy
Adoption curve
Late Majority
Technology maturity
Established Technology
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Duplicati v2.3.0.1 can allow arbitrary code execution when the application is installed outside the default C:\Program Files\Duplicati 2\ directory. The issue involves a LocalSystem service that executes binaries from the Duplicati installation directory, enabling execution of attacker-supplied code with elevated privileges under the described conditions.

The vulnerability affects Duplicati v2.3.0.1 and is identified as CVE-2026-16157. During installation, the MSI registers a LocalSystem service that executes binaries from the Duplicati installation directory. When the default installation path under C:\Program Files\ is used, the directory is protected by the appropriate ACLs. If Duplicati is installed to a non-default location, the installer does not apply equivalent permissions to the installation directory, and standard local users may have write access to files within that directory. An attacker can then place malicious files, such as DLLs, in the directory that may be loaded by the LocalSystem service. The described execution path includes a service restart in which the Windows loader loads the attacker’s DLL before any managed code is executed.

A local attacker with write access to a non-default Duplicati installation directory can replace or introduce DLLs used by the Duplicati service. Upon service restart, the Windows loader loads the attacker’s DLL before any managed code is executed, allowing arbitrary code to run with NT AUTHORITY\SYSTEM privileges.

Install Duplicati in the default installation directory (C:\Program Files\Duplicati 2\). If a non-default installation directory is required, manually configure ACLs that provide equivalent protections to those applied under the C:\Program Files\ directory. Install all vendor patches and updates that address this vulnerability. Vendor information is referenced for additional details.

Valton Tahiri is credited for discovering and reporting the vulnerability, and the document states it was written by Bob Kemerer.

Blog post, originally published by Bob Kemerer at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-guidance-on-duplicati-v2.3.0.1-vulnerability-cve-2026-16157/",
        "name": "CISA Issues Guidance on Duplicati v2.3.0.1 Vulnerability CVE-2026-16157",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-guidance-on-duplicati-v2.3.0.1-vulnerability-cve-2026-16157/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/duplicati-u9vsoe/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/duplicati-u9vsoe/",
      "name": "Duplicati"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Director"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Late Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:30:27-06:00",
    "datePublished": "2026-08-23T09:44:01-06:00",
    "description": "CVE-2026-16157 affects Duplicati v2.3.0.1 when installed outside C:\\Program Files\\Duplicati 2\\, enabling DLL-based code execution via a LocalSystem service.",
    "headline": "CISA Issues Guidance on Duplicati v2.3.0.1 Vulnerability CVE-2026-16157",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Bob Kemerer"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/847406"
    },
    "keywords": [
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-guidance-on-duplicati-v2.3.0.1-vulnerability-cve-2026-16157/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/duplicati-u9vsoe/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/duplicati-u9vsoe/",
        "name": "Duplicati"
      },
      {
        "@id": "https://decisioninsights.ai/projects/duplicati/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/duplicati/",
        "name": "Duplicati"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages