What is the CVSS score of CVE-2026-13268?

CVE-2026-13268 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of G DATA Total Security are affected by CVE-2026-13268?

G DATA Total Security contains a local privilege escalation vulnerability (CVSS 7.8) enabling any authenticated local user to execute arbitrary code with SYSTEM privileges.

How to fix or mitigate CVE-2026-13268?

Within 24 hours, identify all Windows systems running G DATA Total Security and restrict local user account creation; establish monitoring for Backup Service activity and file deletion anomalies. Within 7 days, restrict Backup Service access to administrators only, deploy file integrity monitoring on critical system files, and prepare incident response procedures for detected exploitation. Within 30 days, monitor G DATA security advisories for patch availability and develop a phased deployment plan prioritizing systems with multiple user accounts.

G DATA Total Security CVE-2026-13268

EUVD-2026-50490 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-07-29 zdi

GHSA-9pwf-w3g3-jg2x

Privilege Escalation RCE Total Security G Data

7.8

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local authenticated user (AV:L/PR:L) abuses a SYSTEM service via symlink with no interaction (UI:N); outcome is SYSTEM code execution, giving full C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 19:56 vuln.today

CVE Published

Jul 29, 2026 - 19:08 cve.org

HIGH 7.8

DescriptionCVE.org

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Backup Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28665.

AnalysisAI

Local privilege escalation in G DATA Total Security lets a low-privileged user abuse the Backup Service to delete an arbitrary file via a symbolic link (CWE-59 link following), which can be leveraged to run arbitrary code as NT AUTHORITY\SYSTEM. Discovered and reported through the Zero Day Initiative (ZDI-26-432, ZDI-CAN-28665); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor-assigned CVSS 3.0 base score is 7.8 (High), reflecting full SYSTEM-level compromise achievable by any authenticated local user.

Technical ContextAI

The vulnerability lives in the Backup Service component of G DATA Total Security, a Windows endpoint security/antivirus suite that runs a privileged (SYSTEM) service to perform backup operations. The root cause is CWE-59 (Improper Link Resolution Before File Access, i.e. 'link following'): the SYSTEM-level service performs a file operation - here a file deletion - against a path the attacker controls without first verifying that the path is not a symbolic/junction link. On Windows, a low-privileged user can plant an NTFS junction or symlink (commonly using directory junctions plus object-manager symlinks) so that a delete the service intends to perform against an attacker-writable location is redirected to a protected system file. Arbitrary file deletion as SYSTEM is a well-established primitive that can be converted into code execution (for example via Windows Installer rollback or DLL-planting techniques), which is how the reporter characterizes the impact. The affected software is identified by CPE cpe:2.3:a:g_data:total_security:*:*:*:*:*:*:*:* with no version bound published in the CPE data.

RemediationAI

No vendor-released patch version is identified at time of analysis; the only published reference is the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-432/), which typically coincides with a coordinated vendor fix, so administrators should check G DATA's official update channel and apply the latest Total Security build that addresses CVE-2026-13268 / ZDI-26-432 as the primary remediation. Because the flaw is in the SYSTEM-level Backup Service, interim compensating controls center on limiting who can reach it: restrict local interactive and service-account access on endpoints to reduce the pool of potential low-privileged attackers, and monitor for creation of junctions/symlinks and unexpected deletions in paths touched by the Backup Service (Sysmon file-delete and file-create events). As a last-resort mitigation you could disable or stop the G DATA Backup Service, which removes the vulnerable code path but also disables backup functionality entirely and may reduce the product's protection posture - weigh this against your reliance on that feature. Do not deploy unverified third-party 'fixes'; confirm the patched version directly with G DATA.