Vulnerability · Published Aug 27, 2026 · Assigned by wibu

CVE-2026-81573Improper Access Control in Local-Only Configuration Commands

High 8.6

In plain English

A high-severity improper access control in codemeter-runtime from wibu-systems-ag. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 66.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.

Affected products (as reported)

Vendor	Product	Versions
wibu-systems-ag	codemeter-runtime	9.00 – before 9.108.00 – before 8.41a7.x6.x

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf vendor-advisory