CVE-2026-81573

HighCVSS 8.6/10Last modified Sep 1, 2026

Description

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 27, 2026
Last modified
Sep 1, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-815748.2In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inCVE-2026-815757.5If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data lengthCVE-2026-815767.7If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically CVE-2026-815789.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, uCVE-2026-815798.8In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows CVE-2026-81585.3The Signed Video Framework contained a  buffer overflow issue which could lead the application using this framework to crash. The issue excCVE-2026-815818.8Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pCVE-2026-815835.4The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite inCVE-2026-81597.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filenCVE-2026-81617.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request witCVE-2026-81627.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request witCVE-2026-816238.8IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due