CVE-2026-81572 Local Privilege Escalation in CodeMeter Runtime on Windows
A local attacker can exploit predictable temporary files and NTFS reparse points in CodeMeter Runtime to delete arbitrary files with System privileges, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81572?
CVE-2026-81572 is a high-severity path traversal vulnerability in wibu-systems-ag codemeter-runtime, published on 27 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.
Weakness: CWE-59
Which versions are affected by CVE-2026-81572?
How do I fix CVE-2026-81572?
No fix has been published for CVE-2026-81572 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-81572 being exploited?
There is no known exploitation of CVE-2026-81572 in the wild and no public exploit code.
Sources
Also known as GHSA-c6xr-x2jw-73rp.