What’s Vulnerable › Vulnerabilities
CVE-2026-81573: Improper Access Control in Local-Only Configuration Commands
- Severity: high (CVSS 8.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-27 · updated 2026-09-01
- Weakness: CWE-284
Description
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
Affected products
- wibu-systems-ag codemeter-runtime: from 9.00 before 9.10; from 8.00 before 8.41a; 7.x, 6.x — fixed in 8.41a, 9.10
How to fix
Upgrade to a fixed version: wibu-systems-ag codemeter-runtime 8.41a, 9.10. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-81573 or the next vulnerability affects your stack