{"id":"CVE-2026-19820","title":"Backblaze Client for Windows Improper Link Resolution Vulnerability","summary":"A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level sy…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L","cvssSource":"cna","cwe":["CWE-59"],"vendor":"Backblaze","product":"Backblaze Client","affected":["client 10.0.0.1029","client 10.0.1.1037","client 10.0.2.1047"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-01T15:13:42.323998Z"},"published":"2026-09-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T23:32:25.536Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-19820","references":[{"url":"https://www.backblaze.com/computer-backup/docs/backup-client-release-notes-windows"},{"url":"https://www.backblaze.com/status/update"}],"tags":["cve.org"],"epss":0.00327,"epssPercentile":0.26075,"ingestedAt":"2026-09-11T16:45:47.928Z","slug":"CVE-2026-19820","body":"## Overview\n\nA vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level system change that results in the absence of specific Windows OS security controls. This vulnerability is due to improper link resolution.\n\n## Affected\n\n- `client 10.0.0.1029`\n- `client 10.0.1.1037`\n- `client 10.0.2.1047`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}