CVE-2025-43596 is a high severity (CVSS 7.8) insecure file system permissions flaw in MSP360 Backup 8.0 for Windows. A low privileged user can run commands with SYSTEM rights using a crafted file set as a backup target. The vendor fix is MSP360 Backup 8.1.1.19, released on 15 May 2025.
What's affected
The record lists MSP360 Backup 8.0 on Windows. The vendor guidance in the record and in the CISA CSAF advisory VA-25-119-01 is to upgrade to 8.1.1.19, released on 2025-05-15.
The vendor also changed behaviour. Its help centre says that starting with Backup Agent 8.1.1 for Windows, administrator level access is required to install the application, to create or edit backup and restore plans, to configure pre and post actions such as scripts, and to change settings that affect the endpoint. Non administrator users see restricted options.
The Linux edition has its own entry, CVE-2025-43595. This one is the Windows agent.
How to check if you're exposed
Check the agent version on each Windows machine. In the application, the About screen shows the build. Fleet wide, use your RMM or software inventory to list every install and group by version.
Look for version 8.0 first, then any build below 8.1.1.19. Because the vendor now requires administrator rights for plan changes, also review which standard users on shared machines still hold local administrator rights, since that undoes part of the benefit.
After upgrading, open a backup plan as a standard user and confirm that editing is restricted, as the vendor describes.
What to do now
- Inventory every Windows host with MSP360 Backup and note its version.
- Upgrade to 8.1.1.19 or later, using the newest build available from the vendor.
- Read the vendor page on administrator privileges so help desk staff know why plan editing now asks for elevation.
- Remove local administrator rights from users who do not need them.
- Review backup plans and pre and post action scripts for entries you did not create.
- Check Windows event logs for unexpected service level activity from the backup agent.
Why it matters
The class is incorrect default permissions, CWE-276 (Incorrect Default Permissions). The agent ran backup tasks with SYSTEM rights, and a low privileged user could influence what it ran by choosing a file as a backup target. That crosses a privilege boundary.
The vector says local access and low privileges, with high impact on confidentiality, integrity and availability. In practice this matters on shared computers, terminal servers and workstations where staff do not have administrator rights. It is a way to go from an ordinary account to SYSTEM.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. The vendor change that requires administrator rights for configuration closes the path in a way that survives future bugs of the same kind.
Quick check
Which version fixes it?
MSP360 Backup 8.1.1.19, released on 15 May 2025, per the vendor guidance in the record and the CISA CSAF advisory.
What changed in how the product works?
From Backup Agent 8.1.1 for Windows, the vendor requires administrator privileges to install the agent and to create or edit backup plans, scripts and settings.
Sources
- Gold entry for CVE-2025-43596
- MSP360 Backup administrator privileges requirement
- CISA CSAF advisory VA-25-119-01
- MSP360 Backup for Windows release notes referenced by the record
Last reviewed: 18 October 2026.
