CVE-2026-81573
Received Received - Intake

CodeMeter Runtime Server Configuration Command Handler Remote Access

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: 2fc02b1f-71e7-4514-a878-169626f68903

Description
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81573
EUVD
EUVD-2026-66980

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
wibu codemeter_runtime From 6.x (inc) to 9.x (inc)
wibu codemeter_runtime 8.41a
wibu codemeter_runtime 9.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81573 is a vulnerability in CodeMeter Runtime versions before 8.41a or 9.10 when configured as a server. The issue allows remote attackers to execute commands intended only for local or same-network clients. This can lead to reading sensitive configuration data, overwriting Server.ini values, and taking over the CodeMeter WebAdmin by exploiting credential hashes.

Detection Guidance

Check if CodeMeter Runtime is running as a server by inspecting running processes and listening ports. Use commands like 'netstat -tuln | grep LISTEN' or 'ss -tuln | grep LISTEN' to identify open ports. Verify the version with 'codemeter --version' or check installed packages. Inspect Server.ini for unexpected remote access configurations.

Impact Analysis

If exploited, this vulnerability could allow attackers to remotely access and control CodeMeter servers, leading to unauthorized changes, data leaks, or denial of service. Attackers could gain administrative access via WebAdmin takeover, potentially disrupting operations dependent on CodeMeter Runtime.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected CodeMeter versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Disable the network server functionality if not required. Update CodeMeter Runtime to version 9.10 or later, or 8.41a or later if using version 8.x. Restrict network access to CodeMeter services via firewall rules. Rotate WebAdmin credentials if the server was exposed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart