7.7
High
CVE-2026-81576 If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies…
Description
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| codemeter-runtime 9.00 | 9.00 → < 9.10 | 9.10 |
| codemeter-runtime 8.00 | 8.00 → < 8.41a | 8.41a |
| codemeter-runtime | 7.00 | No fix stated |
| codemeter-runtime | 6.00 | No fix stated |
Other CVEs of codemeter-runtime
The 5 CVEs of codemeter-runtime →
CVE-2026-81575
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which…
7.5
High
CVE-2026-81574
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases,…
8.2
High
CVE-2026-81573
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not…
8.6
High
CVE-2026-81572
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file…
7.8
High