Vulnerability · Published Sep 1, 2026 · Assigned by Bugcrowd

CVE-2026-19820Backblaze Client for Windows Improper Link Resolution Vulnerability

Medium 5.8

In plain English

A medium-severity security flaw in Backblaze Client from Backblaze. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)5.8Medium

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level system change that results in the absence of specific Windows OS security controls. This vulnerability is due to improper link resolution.

Affected products (as reported)

Vendor	Product	Versions
Backblaze	Backblaze Client	10.0.0.102910.0.1.103710.0.2.1047

Weakness: CWE-59 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

In plain English

Official description

Affected products (as reported)

References