High severity · published Aug 27, 2026
CVE-2026-81576
Improper Authentication of Session Handles
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read
license information belonging to another handle.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
codemeter-runtime · wibu-systems-ag
9.00 before 9.10; 8.00 before 8.41a; 7.00; 6.00 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81576
cdn.wibu.com
https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf
More from codemeter-runtime
8.6
CVE-2026-81573
Improper Access Control in Local-Only Configuration Commands
8.2
CVE-2026-81574
Format String Vulnerability in Logger
7.8
CVE-2026-81572
Local Privilege Escalation in CodeMeter Runtime on Windows
7.5
CVE-2026-81575
Missing Sanity Checks for Buffer Lengths