Softland FBackup CVE-2026-2627

Requires authenticated local access to a Windows system with Softland FBackup 9.9 or earlier installed. Attacker must have ability to create symbolic links in directories processed by FBackup backup or restore operations - on Windows 10 1703+ this is possible for standard users in Developer Mode; on earlier Windows versions requires SeCreateSymbolicLinkPrivilege or administrator rights. Attack timing must coincide with scheduled or manual execution of FBackup operations. Exploitation is limited by need to predict or influence file paths the application will access during backup/restore cycles. The CVSS vector PR:L (low privileges required) confirms standard user authentication suffices, while AV:L (local attack vector) and UI:N (no user interaction) indicate the attack is purely technical once access is obtained. Exploitation does NOT work remotely, does NOT work against default installations where users lack symlink privileges (pre-Windows 10 1703), and does NOT succeed if backup operations run with least-privilege service accounts that lack write access to sensitive system directories.

Real-world risk is LOW despite the 7.1 CVSS score. The CVSS vector (AV:L/AC:L/PR:L) indicates local access with low-privilege authentication is required, significantly limiting attack surface compared to remote vulnerabilities. EPSS score of 0.01% (2nd percentile) reflects negligible observed exploitation probability in the wild. This vulnerability is NOT in CISA KEV, indicating no confirmed active exploitation. While public exploit code exists (GitHub PoC), the attack requires: (1) local authenticated access to a Windows system running FBackup, (2) ability to create symbolic links, (3) timing the attack to coincide with backup/restore operations, and (4) predicting file paths the application will access. The vendor's non-responsiveness means no official patch exists, but the combination of local-only vector, low EPSS score, and niche product (backup software) suggests this is a low-priority threat for most organizations. Primary risk scenario: insider threat or post-compromise privilege escalation on systems where FBackup runs with elevated privileges. Not suitable for widespread automated exploitation.

An insider or attacker with existing low-privilege local access to a Windows workstation running FBackup creates a symbolic link in a directory scheduled for backup. When FBackup executes its next backup or restore operation with elevated privileges, it follows the symlink and writes or reads files from a privileged system location (e.g., System32 or administrator home directory). The attacker leverages this to overwrite system files, extract sensitive data, or plant malicious executables that run with system-level privileges. Public exploit code from the ZDI PoC repository provides ready-made attack tooling.