CVE-2026-1995: Privilege Escalation in IDrive Cloud Backup

The impact of CVE-2026-1995 is severe. An attacker with local access to a system running the vulnerable IDrive client can exploit this vulnerability to gain complete control over the system. By overwriting specific files under C:\ProgramData\IDrive\, an attacker can inject and execute malicious code with the privileges of the id_service.exe process, which runs as SYSTEM. This allows for arbitrary command execution, data theft, malware installation, and potentially, lateral movement within the network. The ease of exploitation, requiring only local access and file modification capabilities, significantly broadens the potential attack surface.

1. Reserved2026-02-05
2. Published2026-03-24
3. Modified2026-03-25
4. EPSS updated2026-04-01

The primary mitigation for CVE-2026-1995 is to immediately upgrade the IDrive Cloud Backup Client for Windows to version 7.0.0.63 or later. Prior to upgrading, consider backing up critical data as an extra precaution. If upgrading is not immediately feasible, restrict access to the C:\ProgramData\IDrive\ directory to prevent unauthorized modifications. Implement file integrity monitoring to detect any unexpected changes to these files. While a WAF is unlikely to be effective, consider implementing stricter access controls and auditing on the system to detect suspicious activity. After upgrading, verify the fix by attempting to modify the files in C:\ProgramData\IDrive\ and confirming that the id_service.exe process no longer executes the modified code.