CVE-2026-81572 wibu-systems-ag CVE debrief

Who should care

System administrators and security teams responsible for CodeMeter Runtime installations, particularly those using versions 8.40 to 9.00, should review and apply patches to prevent potential local privilege escalation attacks. IT operations teams and vulnerability management teams should also be aware of the potential impact on their environments and prioritize patching accordingly. Additionally, security teams should monitor system file integrity and review logs for suspicious activity related to CodeMeter Runtime operations.

Technical summary

The CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10 creates a predictable temporary file under C:CM-Stick. A local attacker can create a junction at the temporary file that points to an arbitrary system path, potentially enabling local privilege escalation. This vulnerability is particularly concerning due to CodeMeter Runtime's operation with System privileges, which could allow for arbitrary file deletion and potential elevation of privileges.

Defensive priority

CodeMeter Runtime local privilege escalation vulnerability requires immediate attention due to high CVSS score of 7.8.

Recommended defensive actions

• Review and apply vendor patches for CodeMeter Runtime versions 8.40 to 9.00
• Conduct inventory checks for affected CodeMeter Runtime versions
• Implement compensating controls to monitor and restrict access to sensitive areas
• Verify system file integrity and monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page supports local privilege escalation vulnerability in CodeMeter Runtime. Limited information available on affected scope and vendor remediation. Further review of vendor documentation and system file integrity monitoring is recommended to validate system exposure and patch applicability. CodeMeter Runtime's temporary file creation and junction point handling require defensive scrutiny.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.