Which versions of Bitdefender Total Security are affected by CVE-2026-6851?

Bitdefender Total Security and Internet Security for Windows (versions before 27.0.58.315) are vulnerable to privilege escalation attacks that compromise endpoint security and protection controls.. A patch is available.

How to fix or mitigate CVE-2026-6851?

Within 24 hours: conduct a complete inventory of all Windows endpoints running Bitdefender versions before 27.0.58.315, documenting specific versions and identifying systems handling sensitive data. Within 7 days: restrict local administrative access on affected systems, disable the File Shredder module operationally where feasible, and implement enhanced monitoring for privilege escalation attempts using EDR tools and Windows event logging. Within 30 days: establish vendor contact to obtain estimated patch timeline; create an expedited patch deployment plan ready for 48-hour rollout upon availability; and audit affected systems for indicators of unauthorized privilege escalation.

Bitdefender Total Security CVE-2026-6851

Q: What is the CVSS score of CVE-2026-6851?

CVE-2026-6851 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-43632 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-07-14 Bitdefender

GHSA-f943-xhh7-7c5g

Information Disclosure Microsoft Internet Security Total Security Bitdefender

7.0

CVSS 4.0 · Vendor: Bitdefender

Severity by source

Vendor (Bitdefender) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.7 MEDIUM

Local low-priv attacker (AV:L/PR:L) must win a symlink TOCTOU race (AC:H) and needs the shred operation triggered (UI:R), yielding full local C/I/A impact without scope change.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Bitdefender).

CVSS VectorVendor: Bitdefender

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 14, 2026 - 11:17 EUVD

Analysis Generated

Jul 14, 2026 - 08:15 vuln.today

CVE Published

Jul 14, 2026 - 07:11 cve.org

HIGH 7.0

DescriptionCVE.org

An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links.

This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.

AnalysisAI

Local privilege escalation in Bitdefender Total Security and Internet Security for Windows (versions before 27.0.58.315) lets a less-privileged local user gain higher rights by abusing a symbolic-link race condition in the File Shredder module. Because the shredder operates with elevated privileges and does not safely resolve links before acting on files, an attacker who wins a time-of-check/time-of-use race can redirect a privileged file operation to a target of their choosing. No public exploit identified at time of analysis; the issue was reported by the vendor and requires local access plus user interaction, so EPSS-style mass-exploitation risk is limited.

Technical ContextAI

The affected component is the File Shredder feature of Bitdefender's consumer endpoint suites (CPE cpe:2.3:a:bitdefender:total_security and cpe:2.3:a:bitdefender:internet_security), which permanently overwrites/deletes files and typically runs via a privileged service or helper on Windows. The root cause is CWE-59 (Improper Link Resolution Before File Access, 'link following'): the module accesses a file path without first ensuring it is not a symbolic link or junction, so a low-privileged user can swap the intended path for a link pointing at a protected resource. Combined with a race condition (TOCTOU), the privileged process performs its file operation against the attacker-controlled target rather than the originally validated path, which on Windows commonly manifests as arbitrary file deletion/overwrite that can be chained into privilege escalation.

RemediationAI

Vendor-released patch: update Bitdefender Total Security and Internet Security to version 27.0.58.315 or later; these products auto-update by default, so verify the installed engine/product version and force an update check on managed endpoints. Consult the vendor advisory at https://www.bitdefender.com/support/security-advisories/improper-link-resolution-before-file-access-via-link-following-va-13681 for authoritative fix details. If patching cannot be completed immediately, reduce exposure by avoiding use of the File Shredder feature and by ensuring interactive users are not local administrators and that untrusted users cannot log in locally to affected hosts, since exploitation requires local access plus user-triggered shredding; note these are only stopgaps and do not remove the vulnerable code path, so applying the update remains the definitive fix.