TI-2026-56279 Aliases CVE-2026-81572 GHSA-c6xr-x2jw-73rp

Local Privilege Escalation in CodeMeter Runtime on Windows

LOW 35CWE-59Published 2026-08-27 · Updated 2026-08-28

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00178 7th percentileScored 2026-11-07

Fix Fixed codemeter-runtime (wibu-systems-ag): 8.41a, 9.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wibu-systems-ag	codemeter-runtime	8.40 to before 8.41a; 9.00 to before 9.10	8.41a, 9.10	Patch available	CNA

codemeter-runtime Vendorwibu-systems-ag Affected 8.40 to before 8.41a; 9.00 to before 9.10 Fixed in 8.41a, 9.10 Patch available CNA

Remediation

Fix · CNA codemeter-runtime (wibu-systems-ag) Fixed in 8.41a, 9.10

Timeline

2026-10-02 Threatist record created from CVE-2026-81572
2026-10-03 Alias added: GHSA-c6xr-x2jw-73rp

References

Advisory 1

https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103081.pdf

Other 1

https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codemeter-application

TI-2026-56280 Improper Access Control in Local-Only Configuration Commands CVSS 3.1HIGH 8.6
TI-2026-56281 Format String Vulnerability in Logger CVSS 3.1HIGH 8.2
TI-2026-56286 Memory corruption in wibu-systems-ag wibukey CVSS 3.1HIGH 8.8
TI-2026-56285 An untrusted Pointer Dereference can be exploited to escalate privileges by an unprivileged user on Windows CVSS 3.1HIGH 8.8
TI-2026-56283 Improper Authentication of Session Handles CVSS 3.1HIGH 7.7
TI-2026-56282 Missing Sanity Checks for Buffer Lengths CVSS 3.1HIGH 7.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences