What is the CVSS score of CVE-2026-15681?

CVE-2026-15681 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

AnyDesk CVE-2026-15681

MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-07-13 zdi

RCE Anydesk

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (zdi) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.7 MEDIUM

Local attack vector with high complexity for junction timing; low privileges required; availability-only impact consistent with DoS description.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 14, 2026 - 21:07 NVD

4.7 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 13, 2026 - 22:14 vuln.today

CVE Published

Jul 13, 2026 - 21:31 cve.org

MEDIUM 4.7

DescriptionNVD

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of screen recording files. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26591.

AnalysisAI

Denial-of-service in AnyDesk allows a local attacker with low-privileged code execution to crash or destabilize the application by abusing improper junction resolution during screen recording file operations. The AnyDesk service fails to validate symbolic link or NTFS junction targets before accessing screen recording files, enabling redirection of privileged file creation to arbitrary filesystem paths. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low privilege requirement combined with AnyDesk's common deployment on multi-user systems warrants patching. Note: the provided tag 'RCE' appears to be a mislabeling - the CVE description and CVSS impact metrics consistently describe a DoS-only outcome with no code execution.

Technical ContextAI

CWE-59 ('Improper Link Resolution Before File Access / Link Following') describes a class of vulnerabilities where a privileged process dereferences a user-controlled symbolic link or junction without verifying the true target. On Windows, NTFS junction points allow a low-privileged user to redirect a directory path to an arbitrary target; when a service running with elevated privileges subsequently attempts to create or write a file under that redirected path, it can be made to write to unintended locations. AnyDesk, identified via CPE cpe:2.3:a:anydesk:anydesk:*:*:*:*:*:*:*:*, is a remote desktop application that runs background service components with elevated privileges. The flaw manifests specifically within the screen recording subsystem, where the service creates recording files without adequately hardening the path against junction-based redirection prior to file creation.

RemediationAI

No vendor-released patch version was identified in the available data; the upstream fix status should be confirmed by consulting the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-400/ and the AnyDesk security advisories page directly. Until a patched release is confirmed, the following compensating controls should be considered: disable the screen recording feature within AnyDesk settings if it is not operationally required, as the vulnerable code path depends on this functionality; apply filesystem ACLs to restrict low-privileged users from creating directory junctions or symlinks in paths used by the AnyDesk service (note: this may require group policy configuration and can affect other applications relying on junction creation); and limit local interactive or remote logon rights on systems where AnyDesk is installed to reduce the pool of users who can satisfy the PR:L prerequisite. These mitigations address the exploitation conditions rather than the root flaw and should be replaced by the vendor patch once available.