CVE-2026-13268

Received Received - Intake

G DATA Total Security Backup Service Link Following Local Privilege Escalation

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Zero Day Initiative

Description

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Backup Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28665.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-13268

Affected Vendors & Products

Vendor	Product	Version / Range
g_data	total_security	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This is a local privilege escalation vulnerability in G DATA Total Security Backup Service. Attackers with low-privilege access can create a symbolic link to trick the service into deleting a file, then escalate privileges to execute arbitrary code as SYSTEM.

Detection Guidance

Detection requires identifying the G DATA Total Security Backup Service running with elevated privileges. Check for the service named 'G DATA Total Security Backup Service' in services.msc or via command: sc query "G DATA Total Security Backup Service". Monitor for unexpected file deletions or symbolic link creation in system directories.

Impact Analysis

If exploited, this vulnerability allows attackers to gain full control of your system, install malware, steal data, or perform other malicious actions with highest privileges. It requires local access but can lead to complete system compromise.

Mitigation Strategies

Apply the latest security patch from G DATA if available. Disable the Backup Service if not required using: sc stop "G DATA Total Security Backup Service" and sc config "G DATA Total Security Backup Service" start= disabled. Restrict user permissions to prevent unauthorized service modifications.

Hi! I’m here to help you understand CVE-2026-13268. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70