Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

CodeMeter Runtime may let local user delete any file

CVE-2026-81572 · published 2 months ago
Summary

Versions of CodeMeter Runtime between 8.40 and 8.41a and between 9.00 and 9.10 create temporary files in a predictable location without checking for special links. An attacker with local access can trick the program into deleting any file on the system, because it runs with high privileges. Update to a newer version or apply the vendor’s patch to stop the unsafe file handling.

What to do
  • Update wibu-systems-ag codemeter-runtime to version 8.41a or later.
Affected software
VendorProductAffected versions
wibu-systems-ag codemeter-runtime < 8.41a
Original advisory text
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and fil...
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and
file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file
operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary
system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted
with System privileges and potentially enable local privilege escalation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published27 Aug 2026
Updated3 Nov 2026
First seen27 Aug 2026
Sources
CVE-2026-81572 · NVD
CVE-2026-81572 · MITRE
Track software like this
Free during beta