Which versions of Softland FBackup are affected by CVE-2026-2627?

Softland FBackup versions 9.9 and earlier contain a privilege escalation vulnerability exploitable by local authenticated users through symbolic link manipulation, with publicly available…

Is there a public PoC exploit available for CVE-2026-2627?

Yes, a public proof-of-concept exploit is available for CVE-2026-2627. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2627?

Within 24 hours: inventory all Softland FBackup installations and document version numbers and deployment scope. Within 7 days: evaluate upgrade feasibility to FBackup 10.0 or later if available; if unavailable, restrict local system access to trusted administrators only and implement file system monitoring on backup directories. Within 30 days: complete migration to alternative backup software if vendor patch remains unavailable, or establish a formal risk acceptance for FBackup deployments with documented compensating controls.

Softland FBackup CVE-2026-2627

Q: What is the CVSS score of CVE-2026-2627?

CVE-2026-2627 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-02-17 cna@vuldb.com

Information Disclosure Microsoft

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 29, 2026 - 01:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 29, 2026 - 01:11 vuln.today

cvss_changed

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.8 (HIGH) 7.1 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 18, 2026 - 17:51 vuln.today

Public exploit code

CVE Published

Feb 17, 2026 - 22:18 nvd

HIGH 7.8

DescriptionCVE.org

A security flaw has been discovered in Softland FBackup up to 9.9. This impacts an unknown function in the library C:\Program Files\Common Files\microsoft shared\ink\HID.dll of the component Backup/Restore. The manipulation results in link following. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Link following vulnerability in Softland FBackup 9.9 and earlier allows local authenticated attackers to escalate privileges by manipulating symbolic links processed by the HID.dll library during backup or restore operations. Public exploit code is available via GitHub, but EPSS score remains extremely low (0.01%) and no active exploitation has been reported. The vendor has not responded to disclosure attempts, leaving users without an official patch.

Technical ContextAI

This is a CWE-59 link following vulnerability, also known as a symlink attack or TOCTOU (time-of-check-time-of-use) race condition. The flaw exists in the HID.dll library (C:\Program Files\Common Files\microsoft shared\ink\HID.dll) used by Softland FBackup's backup and restore operations. When the application processes files during backup or restore, it follows symbolic links without proper validation, allowing an attacker to redirect file operations to arbitrary system locations. This class of vulnerability is common in Windows applications that perform privileged file operations without resolving symlinks or validating target paths before access. The affected component (HID.dll) is typically associated with Human Interface Device drivers but appears to be leveraged by FBackup's file handling routines. The attack requires the ability to create symbolic links, which on Windows typically requires SeCreateSymbolicLinkPrivilege or administrator rights in older Windows versions, though Windows 10 1703+ allows unprivileged symlink creation in developer mode.

Affected ProductsAI

Softland FBackup versions up to and including 9.9 are confirmed vulnerable. The flaw specifically affects installations on Windows systems where the application utilizes the HID.dll library located at C:\Program Files\Common Files\microsoft shared\ink\HID.dll during backup or restore operations. No CPE data is available for precise version enumeration. The vendor (Softland) has not issued an advisory or acknowledgment despite early disclosure notification per VulDB submission 752050.

RemediationAI

No vendor-released patch exists - Softland did not respond to disclosure. Until an official fix is available, implement these compensating controls with noted trade-offs: (1) Restrict FBackup execution to high-privilege administrator accounts only and deny standard users access to backup/restore features (trade-off: reduces backup automation for end users). (2) Monitor and alert on symbolic link creation in backup source/destination directories using Windows Event ID 4663 with File System auditing enabled (trade-off: increased logging overhead). (3) Run FBackup backup operations only from controlled, read-only source directories where users cannot create symlinks (trade-off: limits backup flexibility). (4) Deploy application whitelisting (AppLocker/Windows Defender Application Control) to prevent unauthorized symlink manipulation tools (trade-off: administrative overhead). (5) Consider migrating to alternative backup solutions with active vendor security support. Exploit code is publicly available at https://github.com/thezdi/PoC/tree/main/FilesystemEoPs - review for IOCs and detection signatures. Monitor VulDB entries https://vuldb.com/?id.346279 and https://vuldb.com/?ctiid.346279 for vendor response updates.