G DATA Total Security EUVD-2026-50490

Exploitation requires the attacker to already be able to execute low-privileged code on the target (a local, authenticated foothold - PR:L, AV:L), and the G DATA Total Security Backup Service must be installed and running so its privileged file-deletion routine can be abused. The concrete prerequisite is the ability to create a symbolic link/NTFS junction that redirects the Backup Service's file operation to an attacker-chosen target; no user interaction (UI:N) and no elevated privileges are needed beyond the initial low-priv access. Limiting factors: it is not remotely exploitable (local only), it cannot be triggered by an unauthenticated attacker, and it depends on the G DATA Backup Service being present/active on the endpoint - hosts without this product or with the Backup Service disabled are not exposed.

The CVSS 3.0 vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: exploitation is Local (AV:L), requires an already-authenticated low-privileged user (PR:L), needs no user interaction (UI:N), and yields full confidentiality, integrity and availability loss (C:H/I:H/A:H) because the outcome is SYSTEM-level code execution. This is a genuine but bounded risk: it is a strong post-exploitation / local-escalation primitive, not a remotely reachable flaw - an attacker must already have a foothold (malware, a compromised standard user account, or a low-priv service) on the machine. No EPSS score was provided, so probability-of-exploitation cannot be quantified. It is NOT in CISA KEV and no public POC or exploit code was identified, so there is no evidence of active or widespread exploitation; the finding originates from a coordinated ZDI research submission rather than in-the-wild telemetry. No SSVC decision data was supplied. Net: treat as a medium-to-high priority patch on endpoints running this product, but it does not carry the urgency of an unauthenticated remote flaw. Note the vector is CVSS 3.0 (not 3.1) as provided by ZDI.

An attacker who already has a standard (non-admin) account or has landed low-privileged code on a Windows host running G DATA Total Security plants a symbolic link/junction so that a Backup Service file-delete operation is redirected to a protected file. By deleting a chosen SYSTEM-owned file, the attacker triggers a follow-on primitive (e.g. installer rollback or DLL hijack) to execute code as SYSTEM, achieving full machine compromise. No public exploit code was identified at time of analysis, though the technique class is well documented.