CVE-2026-19820: Backblaze Client Privilege Escalation Flaw

CVE-2026-19820 Overview

CVE-2026-19820 is an improper link resolution vulnerability [CWE-59] in the Backblaze Client for Windows. A local user can create a link from a Backblaze folder to Windows operating system files during a backup operation. When the client processes the link, it can affect system files required for boot, rendering the system unbootable.

Successful exploitation requires an administrator-level system change that removes specific Windows OS security controls. The flaw resides in how the Backblaze Client resolves file system links during backup workflows.

Critical Impact
An attacker with local access to a misconfigured host can leverage link following in the Backblaze Client to make the Windows system fail to boot, causing sustained availability loss.

Affected Products

Backblaze Client for Windows (backup agent)
Windows endpoints running vulnerable Backblaze Client versions
See the Backblaze Windows Backup Release Notes for fixed versions

Discovery Timeline

2026-09-01 - CVE-2026-19820 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-19820

Vulnerability Analysis

The vulnerability is classified under [CWE-59] Improper Link Resolution Before File Access, commonly known as a link following or symlink attack. The Backblaze Client processes file system objects inside its managed backup folder without adequately validating whether those objects are symbolic links or hard links pointing outside the intended backup scope.

During a backup operation, a local attacker can plant a link inside a Backblaze folder that resolves to a Windows OS system file. When the client acts on that link, the referenced OS file becomes the target of the backup client's file operations. This can corrupt or displace boot-critical files, preventing Windows from starting.

The advisory notes that successful exploitation requires an administrator-level system change that results in the absence of specific Windows OS security controls. This dependency reduces the practical attack surface but does not eliminate it in environments where those controls have been disabled for compatibility or operational reasons.

Root Cause

The root cause is missing or insufficient link resolution checks in the Backblaze Client's file traversal routine. The client follows links rather than treating them as opaque objects or rejecting them when they resolve outside the designated backup path.

Attack Vector

A local user with write access to a Backblaze-monitored directory creates a symbolic or hard link that points to a boot-critical Windows file. On the next scheduled or triggered backup, the Backblaze Client resolves the link and operates on the OS file. The result is loss of system availability at the next reboot.

No verified public exploit code is available for CVE-2026-19820. See the Backblaze Status Update for vendor communications.

Detection Methods for CVE-2026-19820

Indicators of Compromise

Creation of symbolic links or NTFS junctions inside directories monitored by the Backblaze Client that resolve to paths under C:\Windows\, C:\Windows\System32\, or the EFI system partition.
Backblaze Client logs showing backup operations that traversed paths outside the configured backup scope.
Windows boot failures immediately following a Backblaze backup cycle on an affected host.

Detection Strategies

Monitor for use of mklink, CreateSymbolicLink, or CreateHardLink API calls originating from non-administrative user sessions within Backblaze-tracked folders.
Alert on file system events where a link is created and the target path resolves to a protected OS directory.
Correlate Backblaze Client process activity (bzbackup.exe and related binaries) with writes or metadata operations against Windows system files.

Monitoring Recommendations

Enable Windows Security auditing for object access on OS system directories and forward events to a centralized logging platform.
Track integrity of boot files and critical system binaries using file integrity monitoring.
Review Backblaze Client version inventory across endpoints and flag hosts running versions prior to the fixed release.

How to Mitigate CVE-2026-19820

Immediate Actions Required

Update the Backblaze Client on all Windows endpoints to the fixed version listed in the Backblaze Windows Backup Release Notes.
Verify that Windows OS security controls disabled by prior administrator actions are re-enabled where feasible.
Restrict local user write access to directories included in Backblaze backup sets.

Patch Information

Backblaze has issued client updates that address the improper link resolution behavior. Consult the vendor's Windows backup client release notes for the specific fixed version and refer to the Backblaze Status Update page for advisory information.

Workarounds

Exclude directories writable by non-administrative users from Backblaze backup scope until the client is patched.
Enforce NTFS permissions that prevent standard users from creating symbolic links in backup-monitored folders.
Disable the SeCreateSymbolicLinkPrivilege for standard users through Group Policy to block symbolic link creation.

bash

# Group Policy path to restrict symbolic link creation
# Computer Configuration > Windows Settings > Security Settings
#   > Local Policies > User Rights Assignment
#   > "Create symbolic links" -> Administrators only

# Verify current assignment from an elevated PowerShell prompt
whoami /priv | findstr SeCreateSymbolicLinkPrivilege