Vulnerability · Published Jul 13, 2026 · Assigned by zdi

CVE-2026-15682AnyDesk Support Information Link Following Denial-of-Service Vulnerability

Medium 4.7

In plain English

A medium-severity security flaw in AnyDesk from AnyDesk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.0)4.7Medium

Exploit odds (30 days)0.1%top 96.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Send Support Information feature. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26645.

Affected products (as reported)

Vendor	Product	Versions
AnyDesk	AnyDesk	9.0.4

Weakness: CWE-59 · Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References

ZDI-26-401 x_research-advisory