Vulnerability · Published Aug 27, 2026 · Assigned by wibu

CVE-2026-81572Local Privilege Escalation in CodeMeter Runtime on Windows

High 7.8

In plain English

A high-severity security flaw in codemeter-runtime from wibu-systems-ag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.

Affected products (as reported)

Vendor	Product	Versions
wibu-systems-ag	codemeter-runtime	8.40 – before 8.41a9.00 – before 9.10

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103081.pdf vendor-advisory
https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codemeter-application technical-description