Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.
A vulnerability in the Backblaze Personal Computer Backup service allows a local attacker with limited privileges to compromise the operating system's bootability. The flaw, published September 9, 2026 in advisory ZDI-26-628 and tracked as CVE-2026-19820, exploits a classic weakness in symbolic link resolution to induce the backup software to overwrite arbitrary files, including critical Windows components.
- Vulnerability ZDI-26-628 affects the bzreports component of the Backblaze Service on Windows, which runs with elevated privileges
- A local attacker with low-privilege code execution creates a symlink that the service follows during backup operations, overwriting system files
- CVE-2026-19820 assigns a CVSS 4.0 score of 5.8 (MEDIUM) and classifies the flaw as CWE-59 Improper Link Resolution Before File Access
- According to the CVE record, the exploit can render the system unbootable; coordinated disclosure occurred after approximately 154 days from the initial vendor report
The Mechanism: When Backup Follows the Wrong Link
The specific flaw resides in the Backblaze Service, the system process that manages backup and reporting operations. During bzreports-related operations, the service accesses files without first resolving symbolic links, a gap classified as CWE-59: Improper Link Resolution Before File Access.
An attacker with local access and the ability to execute low-privilege code creates a symbolic link inside the folder monitored by Backblaze. The symlink points to a Windows system file. When the service, running with elevated privileges, processes that folder, it follows the link and overwrites the target file with backup data. The operation occurs transparently, within the normal context of the software's functionality.
"By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files." — Advisory ZDI-26-628
The stated impact is a denial-of-service condition on the affected system. According to the CVE record, overwriting critical system files can render the system unbootable. The vulnerability does not allow remote code execution or direct privilege escalation: the perimeter remains local, but the consequences are systemic.
The Risk Profile: Why a CVSS 5.8 Masks Severe Impact
The CVSS 4.0 score of 5.8, rated MEDIUM, may appear moderate. The metric reflects the attack constraints: local access required, limited interaction with an existing service, no confidentiality or integrity of user data as a primary objective. The impact on availability is pronounced, however, with consequences that exceed simple application malfunction.
The CVE record specifies that the exploit requires "an administrator-level modification that results in the absence of specific Windows OS security controls." This prerequisite does not reduce risk for installations operating under standard conditions, but indicates that the target configuration includes a system variable: the environment in which the control has already been removed or bypassed.
The attack profile represents a category of threats underestimated in system software. Backup services require elevated privileges to access the entire filesystem, which naturally exposes them to filesystem abuse techniques. The symlink is a vector known for decades, whose mitigation requires explicit path validation before access.
The Disclosure: Five Months of Coordination Without Confirmed Patch
The documented timeline shows an interval of approximately 154 days between the initial report and coordinated publication. The vendor received the report on April 7, 2026; the ZDI advisory was released publicly on September 9, 2026. None of the available sources confirm the release of a corrective patch by Backblaze during this interval.
The ZDI advisory does not specify affected product versions nor provide a direct URL to a security update. This absence, combined with the lack of details on available patches, leaves users without a documented mitigation path. The CVE record does not integrate additional information on the remediation status.
"A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup." — CVE Record CVE-2026-19820
The identity of the researcher who discovered and reported the flaw does not appear in the advisories consulted. The ZDI program, managed by Trend Micro, proceeded with standard coordination without public attribution.
The Systemic Pattern: When Protection Software Becomes an Attack Vector
This vulnerability falls into a recurring pattern in Windows system software: services that operate with elevated privileges and access paths controllable by non-privileged users. Automatic backup, by definition, must traverse directories that can be manipulated. The failure to validate symbolic links turns this functional necessity into an attack surface.
The difference from a simple file deletion by a malicious user lies in the induction mechanism: the attacker does not act directly on system files, but configures an artifact in their own user space that the trusted service executes with higher privileges. This is technically a TOCTOU (Time-of-Check to Time-of-Use) attack applied to path resolution.
The CVE record introduces an element of caution in its text: the prerequisite of an administrative modification that removes security controls. This could refer to configurations that disable symbolic link protection in specific contexts, or to conditions where the service operates with broader privileges than necessary. The dossier does not clarify the exact nature of this modification, nor its prevalence in real-world installations.
What We Know and What Is Missing
The consolidated dossier confirms the technical mechanism, attack conditions, and severity of potential impact. The following remain undocumented: specific versions of Backblaze Personal Computer Backup found vulnerable, existence of a vendor-released patch, presence of a public exploit or proof-of-concept, number of potentially exposed installations, and any evidence of exploitation in the wild.
For users of the service, the situation presents operational uncertainty. Without indications on patched versions, it is impossible to determine whether the current installation is protected. The absence of official communications from Backblaze in the available dossier does not allow integration of vendor statements into the risk assessment.
The ZDI program, through its upcoming advisory list, confirmed that ZDI-26-628 falls within the regular coordinated disclosure cycle. This context, purely procedural, adds no technical elements but positions the vulnerability within a structured, peer-reviewed zero-day management flow.
Sources
Information verified against cited sources and current as of publication.
Sources
Get DeafLetter
A weekly selection of signals, vulnerabilities and guides. Critical alerts remain optional.
You can unsubscribe at any time. Privacy policy.