CVE-2026-13268

Executive Summary

CVE-2026-13268 is a locally exploitable privilege escalation vulnerability in the G DATA Total Security Backup Service, identified by ZDI researchers as ZDI-CAN-28665. The flaw stems from an insecure symbolic link following operation (CWE-59) that allows a low-privileged local attacker to abuse the privileged Backup Service (running as SYSTEM) into deleting an arbitrary file on the filesystem. Successful exploitation enables full escalation to SYSTEM privileges, allowing arbitrary code execution, data exfiltration, or complete system compromise. As of this report, the vulnerability is UNPATCHED with no vendor fix, workaround, or public proof-of-concept available; however, the attack vector is well-understood given the vulnerability class.

Technical Analysis

The vulnerability resides in the Backup Service component of G DATA Total Security. The service runs with high integrity (SYSTEM) privileges and handles file operations related to backup jobs, including scheduled deletions of temporary or outdated backup artifacts. The core flaw is an unsafe handling of file paths supplied via inter-process communication (IPC) or file-system events.

Mechanism: The Backup Service performs a file deletion operation on a path that is either fully or partially attacker-influenced. The service fails to validate whether the target path is a legitimate file or a symbolic link (symlink) before performing the deletion. A local attacker with low privileges (e.g., a standard user) can pre-create a directory junction or symbolic link at a location the service is expected to traverse, redirecting the service's "delete" operation to a critical system file (e.g., C:\Windows\System32\config\SAM, a driver file, or a DLL loaded by a privileged process).

Detailed Vulnerability Flow:

1. Path Control: The service is triggered (e.g., via a scheduled task, manual backup, or a malformed IPC request) to clean up temporary files in a user-writable directory, such as C:\Temp\BackupCache\.
2. Symlink Creation: The attacker pre-creates a symlink (using mklink or junction.exe) at C:\Temp\BackupCache\ pointing to C:\Windows\System32\.
3. Service Action: The service issues a DeleteFile() call on the path C:\Temp\BackupCache\config\SAM.bak. Due to the symlink, the OS resolves this to C:\Windows\System32\config\SAM.bak.
4. Privileged Deletion: The service (running as SYSTEM) deletes the target file. While deleting SAM.bak alone may not grant code execution, the attacker can target any file, including a file they do not have permission to delete (e.g., a protected system DLL or executable).
5. Execution: By deleting a file that is then replaced with a malicious version, or by deleting a file that causes a privileged service to fail and subsequently load a malicious library, the attacker can achieve arbitrary code execution in SYSTEM context.

Attack Surface: The attack surface is limited to local users who can execute code on the system. This includes standard users on a shared workstation, users of a virtual desktop infrastructure (VDI), or any scenario where an unprivileged process runs on a machine with G DATA Total Security installed.

CWE-59 Context: The vulnerability is classified as "Improper Link Resolution Before File Access ('Link Following')." The service does not use CreateFile with the FILE_OPEN_REPARSE_POINT flag or validate the final path after resolution, which is the standard mitigation against symlink attacks.

Exploitation Scenarios

The following is a concrete, step-by-step attack chain. While no public PoC exists, this matches the standard exploitation techniques for CWE-59 vulnerabilities in Windows services.

Pre-requisites: Attacker has local access to a system with an unpatched version of G DATA Total Security and can execute code as a standard user (e.g., via a malicious macro, a compromised application, or physical access).

Step 1: Reconnaissance & Target Identification

• The attacker enumerates running services via sc query and identifies the Backup Service (typically named GD Backup Service or similar).
• The attacker inspects the service's executable path and its associated directories for writable locations. Using tools like Sysinternals Process Monitor (ProcMon), they filter for DeleteFile and SetDispositionInformationFile operations to identify writable directories the service interacts with during backup/cleanup cycles.
• Target file selection: The attacker chooses a file critical to a second-stage exploit. For example, deleting C:\Windows\System32\wbem\WMIC.exe is not useful. Instead, they target a DLL loaded by a SYSTEM-level auto-start service, such as C:\Windows\System32\DriverStore\...\some.dll, or a service binary, planning to replace it after deletion.

Step 2: Trigger & Weaponization

• The attacker logs in as a standard user and creates the malicious directory structure.
• Using cmd.exe or PowerShell:

  mkdir C:\Temp\BackupCache
  mklink /J C:\Temp\BackupCache\TargetDir C:\Windows\System32
  

• They then copy a legitimate file into the target path to ensure the service does not fail early if the file is missing:

  copy C:\Windows\System32\winlogon.exe C:\Windows\System32\Target.dll  (as a placeholder if permissions permit; otherwise, they target a file in a protected but service-accessible path).
  

• The attacker triggers the backup service's file cleanup operation. This could be done by:
  • Starting a new backup job via the G DATA GUI (if allowed for standard users).
  • Sending a crafted IPC message to the service (reversing the service's protocol).
  • Waiting for the scheduled cleanup task.

Step 3: Payload & Execution

• The service processes the cleanup request and invokes DeleteFileW(L"C:\\Temp\\BackupCache\\TargetDir\\Target.dll"). The symlink resolves this to C:\Windows\System32\Target.dll, and the SYSTEM-context service deletes the file.
• The attacker quickly drops a malicious DLL named Target.dll into C:\Windows\System32\ (now writable because the legitimate file is gone, and the attacker has Write access to the directory).
• The attacker reboots the system or triggers a restart of the target service (e.g., sc stop VulnerableService if permissions allow, or by waiting for the OS to restart).
• The targeted service loads the malicious DLL in SYSTEM context, executing arbitrary code (e.g., a reverse shell or a credential dump).

Step 4: Post-Exploitation Impact

• The attacker now has a SYSTEM-level shell. They can:
  • Dump LSASS memory to harvest domain credentials.
  • Install persistent backdoors (services, scheduled tasks, WMI event subscriptions).
  • Disable security controls (though G DATA is the compromised product).
  • Move laterally across the network using harvested credentials.

Alternative Attack Variant: Instead of targeting a system DLL, the attacker can target a file that the service itself uses, causing a logic bypass that leads to execution of an attacker-supplied script or binary (e.g., if the service runs an .exe after a failed delete, the attacker can plant it in the expected path).

Impact Assessment

• Technical Impact: Critical — Confirmed local privilege escalation to SYSTEM.
  • Confidentiality: High (CVSS 3.0 C:H) — Full read access to all local files and processes.
  • Integrity: High (CVSS 3.0 I:H) — Ability to modify system files, disable security, and install malware.
  • Availability: High (CVSS 3.0 A:H) — Ability to delete critical system components, causing denial-of-service.
• Business Impact: An attacker who successfully exploits this CVE can gain total control over the affected workstation. In an enterprise environment, this provides a foothold for lateral movement, enabling domain compromise. The attack requires local access, mitigating purely remote exploitation, but it significantly elevates the impact of any other vulnerability (e.g., a browser RCE or phishing payload) that grants initial code execution.
• Affected Systems: All endpoints running G DATA Total Security with the Backup Service enabled. This includes Windows workstations and servers where the product is installed.
• Blast Radius: The initial compromise is local, but the subsequent SYSTEM access makes the machine a launching pad for network-wide attacks. The severity is amplified on VDI or Citrix environments where many users share the same underlying image.

Detection Guidance

Sigma Rule

title: G DATA Backup Service Creating Symlink or Junction
id: 4f0b82cc-6d9f-4f2a-9d1c-1e2a9b7f4c10
status: experimental
description: Detects the creation of a symbolic link or junction point in a directory watched by the G DATA Backup Service, indicating a potential CVE-2026-13268 exploitation attempt.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13268
author: Valtersit Threat Intel
logsource:
    product: windows
    category: file_event
detection:
    selection:
        EventID: 1  # Sysmon Process Creation
        Image|endswith: '\cmd.exe' OR '\powershell.exe' OR '\junction.exe'
        CommandLine|contains:
            - 'mklink'
            - '/J'
    filter:
        User|endswith: '\\SYSTEM'  # Exclude legitimate system operations if known
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate administrative scripts that create junctions for backups
fields:
    - CommandLine
    - User
    - ParentImage
tags:
    - attack.t1574
    - attack.privilege-escalation

YARA Rule

rule G_DATA_CVE_2026_13268_Symlink_Attack
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects commands commonly used to create junctions or symlinks for exploiting G DATA Backup Service"
        reference = "CVE-2026-13268"
        date = "2026-10-01"
    strings:
        $s1 = "mklink" ascii wide nocase
        $s2 = "/J" ascii wide nocase
        $s3 = "junction.exe" ascii wide nocase
        $s4 = "GDBackup" ascii wide nocase
        $s5 = "BackupCache" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and 1 of ($s4, $s5)
}

Suricata IDS Rule

Note: This vulnerability is local and does not generate network traffic directly. However, lateral movement or C2 traffic post-exploitation can be detected.

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"G DATA CVE-2026-13268 Post-Exploitation C2 Beacon"; flow:to_server,established; content:"|2e 2e 2f|"; http.uri; content:"cmd"; http.uri; classtype:trojan-activity; sid:202613268; rev:1;)

Note: The above rule is a placeholder; in practice detection should focus on file system telemetry and process auditing rather than network IDS for this local vulnerability.

Elastic Detection

// Detect process creation events where a user creates a symlink/junction
process where event.action == "start" and
  process.name : ("cmd.exe", "powershell.exe", "junction.exe", "mklink") and
  process.command_line : ("*mklink*", "*junction*", "*/J*") and
  not user.name : "SYSTEM"

// Detect file deletion events in sensitive system directories by the G DATA service
file where event.action == "deletion" and
  process.name : "*GD*Backup*" and
  file.path : ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")

Splunk SPL Query

index=windows EventCode=1
| search (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*junction.exe") AND CommandLine="*mklink*"
| stats count by User, CommandLine, ParentImage
| where NOT User="NT AUTHORITY\\SYSTEM"

index=windows EventCode=4688 (NewProcessName="*\\cmd.exe" OR NewProcessName="*\\powershell.exe") AND ProcessCommandLine="*/J*"
| table _time, User, NewProcessName, ProcessCommandLine

Wazuh OSSEC Rule

<group name="sysmon,">
  <rule id="100268" level="12">
    <if_sid>92050</if_sid> <!-- Sysmon process creation event -->
    <field name="win.eventdata.commandLine">mklink|/J|junction</field>
    <description>CVE-2026-13268 suspected exploitation: Symlink creation detected for G DATA Backup Service bypass.</description>
    <group>gdata,privilege_escalation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source)

No official patch is available. The following mitigations are recommended, listed in order of priority:

1. Immediate Mitigations (Local Access Restriction):

   • Disable the Backup Service: If not essential to business operations, immediately disable the "G DATA Backup Service" (sc config <ServiceName> start= disabled) to remove the vulnerable attack surface.
   • Restrict Local Logon: Reduce the number of users with interactive logon on systems running G DATA Total Security. This reduces the attack surface.
   • Application Control: Deploy application whitelisting (e.g., AppLocker or Defender Application Control) to block the execution of mklink, junction.exe, and cmd.exe for non-administrative users.

2. Patch/Upgrade Steps:

   • Contact G DATA CyberDefense for a patched version. Monitor the vendor's advisory portal for CVE-2026-13268 (ZDI-CAN-28665).
   • Until a patch is released, do not install G DATA Total Security on systems with a high trust boundary for local users (e.g., Kiosks, public-facing terminals).

3. Long-term Hardening:

   • Enable Windows Reparse Point Protections: Ensure the system policy "Do not allow reparse points for folders" or similar GPOs are enabled for non-administrative users if possible.
   • Audit Service Permissions: Review and restrict access to the Backup Service's executable path to prevent replacement or configuration tampering.
   • Continuous Monitoring: Deploy the Sigma/YARA/Elastic rules provided to detect attempts to create symlinks and match them against service behavior.

Recommended Action: This vulnerability is high-risk due to its SYSTEM-level impact. If the Backup Service is not strictly necessary, disabling it is the fastest mitigation. If it is required, isolate the machine footprint and restrict local logons to only trusted IT personnel until a patch is available.

References

1. NVD Entry — CVE-2026-13268: https://nvd.nist.gov/vuln/detail/CVE-2026-13268
2. ZDI Advisory — ZDI-CAN-28665: https://www.zerodayinitiative.com/advisories/ZDI-CAN-28665/
3. MITRE ATT&CK Technique — T1574: Hijack Execution Flow: https://attack.mitre.org/techniques/T1574/
4. CWE-59 Specification: https://cwe.mitre.org/data/definitions/59.html
5. CISA Known Exploited Vulnerabilities Catalog (Not listed as of 10/2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog