ZDI-26-627: Backblaze Personal Computer Backup bztransmit Link Following Denial-of

Zerodayinitiative • September 9, 2026

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Backblaze Service. By creating a symbolic link, an attacker can abuse the service to overwrite arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

Fixed in Release Version 10.0.1.1069 ( )

2026-04-07 - Vulnerability reported to vendor

2026-09-09 - Coordinated public release of advisory

2026-09-09 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Denial-of-Service Vulnerabilities in Backblaze Backup Software Five vulnerabilities (ZDI-26-624, ZDI-26-625, ZDI-26-626, ZDI-26-627, ZDI-26-628) have been identified in Backblaze Personal Computer Backup, allowing local attackers to create a denial-of-service condition. Exploitation requires low-privileged code execution on the target system, where attackers can create symbolic links to overwrite arbitrary files. All vulnerabilities were reported to the vendor on April 7, 2026, and have been patched in Release Version 10.0.1.1069. The coordinated public release of advisories occurred on September 9, 2026, with updates provided on the same day. Users of Backblaze Personal Computer Backup are urged to update to the latest version to mitigate these risks. 5 sources 31

Extracted Entities

ZDI-26-627: Backblaze Personal Computer Backup bztransmit Link Following Denial-of

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (2)