VDB
CVE-2026-81576
CVE-2026-81576
PUBLISHED
CVSS 7.7 HIGH
Reported by wibu · Published August 27, 2026
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
Risk Scores
CVSS 3.1
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wibu-systems-ag | codemeter-runtime | 9.00, 8.00, 7.00 |
| wibu-systems-ag | codemeter-runtime | 9.00, 8.00 |
| wibu-systems-ag | codemeter-runtime | 9.00, 8.00, 7.00 |
Timeline
- Aug 27, 2026 EPSS Score
- Aug 27, 2026 Coalition ESS Score
- Aug 27, 2026 CVE Published
- Aug 27, 2026 CVE Updated
- Sep 1, 2026 EPSS Score