CVE-2026-19820: CWE-59 Improper Link Resolution Before File Access in Backblaze Backblaze Client

This vulnerability in Backblaze Client arises from improper link resolution before file access (CWE-59). A local attacker with administrator privileges can create a symbolic link from the Backblaze backup folder to critical Windows OS system files during a backup operation. This can lead to system instability or prevent the system from booting. The vulnerability requires elevated privileges and specific Windows security controls to be disabled or absent. No known exploits are reported in the wild, and no patch or remediation information is provided in the available data.

Successful exploitation can render the Windows system unbootable, causing denial of service to the affected system. The attack requires administrator-level access and specific security controls to be missing, limiting the scope of impact to privileged users in a weakened security environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that Windows OS security controls are enabled and restrict administrator-level access to trusted users only. Monitor for any vendor updates regarding patches or official mitigations.