AnyDesk CVE-2026-15681

Exploitation requires that the attacker has already achieved local code execution on the target system with at minimum low-privileged access (consistent with CVSS PR:L). The attack is further constrained by AC:H, meaning successful junction placement must occur within a specific timing window or under conditions that are not trivially reproducible - likely a race between the attacker creating the junction and the AnyDesk service resolving the screen recording file path. AnyDesk must be installed and operational on the system, and the screen recording functionality must be reachable or triggerable. The scope is limited to the local system (S:U); lateral movement or remote exploitation of additional systems is not a factor. Exploitation is prevented on systems where low-privileged users lack permission to create directory junctions, or where the screen recording feature is administratively disabled.

The NVD CVSS 3.0 base score of 4.7 (Medium) reflects a realistic threat profile: AV:L constrains exploitation to attackers already present on the target system, and AC:H signals that successful exploitation requires a non-trivial setup - likely a race condition or careful junction placement before the service accesses the recording path. PR:L confirms that low-privileged code execution is a prerequisite, not a trivially available primitive. The impact is strictly availability (A:H), with no confidentiality or integrity loss recorded by the vendor. No EPSS data was provided in the input, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. The 'RCE' tag in the source metadata conflicts directly with the CVE description and CVSS I:N/C:N - this inconsistency must be verified before escalating response priority. Real-world risk is moderate in shared workstation or VDI environments where multiple low-privileged users can execute code on machines running AnyDesk, but negligible for single-user endpoints with controlled local access.

An attacker with low-privileged local access - for example, a standard domain user on a shared workstation running AnyDesk - pre-positions an NTFS junction at the directory path where AnyDesk writes screen recording files, redirecting it to a sensitive or critical system path. When the AnyDesk service subsequently initiates a screen recording operation, it follows the junction and attempts to create files at the attacker-controlled target, either causing the service to crash due to access violations or consuming resources at the redirected path in a way that degrades system availability. No public proof-of-concept code was identified at the time of this analysis.