CodeMeter Runtime CVE-2026-81576

Exploitation requires CodeMeter Runtime to be explicitly configured in server mode - this is not the default client-only deployment and represents a deliberate administrative decision. The CVSS PR:L confirms the attacker must first establish a low-privilege authenticated connection to the CodeMeter server before brute-forcing peer sessions' SIDs; unauthenticated network access alone is insufficient. Successful exploitation additionally requires at least one concurrent victim session to be active on the server at the time of attack, as the attacker targets handles belonging to simultaneous live connections. Factors limiting exploitation include the server-mode configuration prerequisite, network reachability to the CodeMeter server port, and the dependency on concurrent victim sessions being present. No victim user interaction is required once network access is obtained.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N reflects a network-reachable, low-complexity attack requiring only a low-privilege connection, consistent with the brute-force SID approach described. The Scope:Changed metric correctly captures the cross-session license data disclosure, as the attacker reaches data belonging to a different client's authorization context on the same server. EPSS data is absent from the provided intelligence and CISA KEV status is unconfirmed, so active exploitation has not been established - no public POC is listed, which further reduces immediate urgency relative to a fully weaponized vulnerability. The primary risk amplifier is the low attack complexity: once any low-privilege connection is established, SID enumeration requires no specialized tooling, making this accessible to a broad range of attackers. The impact is bounded to confidentiality - integrity and availability are both unaffected - so the practical harm is unauthorized disclosure of other clients' license entitlement metadata rather than code execution or service disruption. Priority remediation is warranted for server-mode deployments exposed to untrusted networks.

An attacker who has established a legitimate low-privilege connection to a network-exposed CodeMeter server systematically cycles through SID values, exploiting the weak entropy of the SID generation algorithm. The server, which uses the SID as its sole connection authenticator, accepts a correctly guessed SID belonging to a concurrent victim session and returns the associated handle number. The attacker then queries the server using the victim's handle to read that client's license entitlement data without any further authentication. No public exploit code has been identified at time of analysis, but the brute-force approach requires no specialized tooling given the weak SID entropy.