8.6
High
CVE-2026-81573 If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not…
Description
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| codemeter-runtime 9.00 | 9.00 → < 9.10 | 9.10 |
| codemeter-runtime 8.00 | 8.00 → < 8.41a | 8.41a |
| codemeter-runtime | 7.x | No fix stated |
| codemeter-runtime | 6.x | No fix stated |
Other CVEs of codemeter-runtime
The 5 CVEs of codemeter-runtime →
CVE-2026-81576
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies…
7.7
High
CVE-2026-81575
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which…
7.5
High
CVE-2026-81574
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases,…
8.2
High
CVE-2026-81572
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file…
7.8
High