CVE-2026-13268: G DATA Total Security link following privilege escalation in Backup Service

CVE-2026-13268 · Severity: high · CVSS 7.8 · Published 2026-07-29

A vulnerability in G DATA Total Security's backup component could allow a user with limited access to a computer to gain full administrative control. By manipulating how the software handles file shortcuts during backup operations, an attacker can delete protected files and execute their own code with the highest level of system permissions. This could lead to a complete compromise of the affected machine, including the theft of sensitive data or the disabling of security protections.

Quick answers

Is CVE-2026-13268 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13268 being exploited in the wild.
How severe is CVE-2026-13268?
High severity, with a CVSS score of 7.8, published 29 July 2026.
Which products and versions are affected?
G DATA Total Security 25.5.19.439.
Is there a fix for CVE-2026-13268?
A patch was published on 2026-07-15: Fixed in version 25.5.20.121 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13268 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-13268?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A local privilege escalation vulnerability exists in the G DATA Total Security Backup Service due to improper link resolution (CWE-59). The flaw occurs when the service processes file operations, allowing a low-privileged attacker to create symbolic links that redirect the service's file deletion actions to unintended locations. By exploiting this link-following behavior, an attacker can delete sensitive system files or manipulate the environment to achieve arbitrary code execution with SYSTEM privileges. The attack requires the adversary to already have local code execution capabilities on the target host. The vulnerability is addressed in version 25.5.20.121.

Affected products

  • G DATA Total Security 25.5.19.439

Timeline

  • 2026-02-12: disclosed: Vulnerability reported to vendor
  • 2026-07-15: patched: Fixed in version 25.5.20.121
  • 2026-07-15: advisory: Coordinated public release of advisory ZDI-26-432

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.