7
CVEs
0
Critical
7
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
7
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (2)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-81573 | CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler to arbitrary remote peers due to absent network-origin restrictions. Unauthenticated remote attackers (PR:N per CVSS) can read sensitive configuration data and overwrite values in Server.ini, most critically the WebAdmin credential hash, enabling full WebAdmin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 8.6 rating and PR:N attack vector make this a genuine priority for any organization running CodeMeter in server mode. | HIGH | 8.6 | 0.5% | 48 |
|
| CVE-2026-81581 | WibuKey64.sys kernel-mode driver in Wibu-Systems WibuKey up to version 6.70 for Windows allows a local, low-privileged attacker to trigger memory boundary violations by supplying out-of-scope pointer values, with outcomes ranging from denial of service (BSOD) to full SYSTEM-level privilege escalation via kernel code execution. The CVSS Scope:Changed metric reflects the critical boundary crossing from user-space into the driver's SYSTEM-privileged kernel context, meaning successful exploitation yields complete machine control from an unprivileged account. No public exploit has been identified at time of analysis and WibuKey has not been listed in the CISA KEV catalog, but the low attack complexity makes this a high-value local privilege escalation primitive for post-compromise chains. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-81579 | Local privilege escalation in WibuKey for Windows before 6.71 allows any low-privileged local user to gain full SYSTEM-level control by exploiting a write-what-where primitive in the WibuKey2_64.sys kernel driver. The root cause is an untrusted pointer dereference (CWE-123) in the 64-bit kernel driver, meaning attacker-controlled data is used directly as a kernel-space pointer, enabling arbitrary writes into kernel memory - a classic and highly reliable LPE primitive. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-81574 | Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. The vulnerability is trivially exploitable locally via the cmu CLI tool and becomes remotely exploitable without authentication when chained with CVE-2026-81573; no public exploit has been identified at time of analysis. | HIGH | 8.2 | 0.4% | 41 |
|
| CVE-2026-81572 | Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary files with SYSTEM privileges via an NTFS junction attack, potentially cascading to full system compromise. The cmu.exe utility creates predictable temporary files under C:\CM-Stick without validating NTFS reparse points before performing file operations; because the CodeMeter Runtime service runs as SYSTEM, any redirected file operation executes at the highest privilege level. A detailed public research writeup is available from shelltrail.com, substantially lowering the exploitation barrier; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV. | HIGH | 7.8 | 0.2% | 39 |
|
| CVE-2026-81576 | Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. No public exploit has been identified at time of analysis, but the low attack complexity and network accessibility make this a realistic threat wherever CodeMeter is deployed in server mode. | HIGH | 7.7 | 0.3% | 39 |
|
| CVE-2026-81575 | CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed data length field, allowing remote unauthenticated attackers to trigger an out-of-bounds read and segmentation fault. Wibu-Systems versions before 8.41a and 9.10 are confirmed affected. The impact is a full service crash, denying access to any software whose licensing depends on the CodeMeter Runtime server - no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.5 | 0.4% | 38 |
|