# CVE-2026-15682: AnyDesk link following denial of service in Send Support Information

Source: https://junglewise.ai/threats/cve-2026-15682-anydesk-link-following-denial-of-service-in-send-support  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-15682 · Severity: medium · CVSS 4.7 · Published 2026-07-13

A vulnerability in AnyDesk, a popular remote desktop application, could allow a local user to crash the software or disrupt system operations. By exploiting a flaw in how the application handles support information requests, an attacker who already has limited access to a computer can create unauthorized files that interfere with the system's stability. This could lead to a denial-of-service, preventing legitimate users from accessing the remote desktop service or other system functions.

Technologies: [AnyDesk](https://junglewise.ai/threats/technologies/anydesk). Vendors: [AnyDesk](https://junglewise.ai/threats/vendors/anydesk).

## Quick answers

**Is CVE-2026-15682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15682 being exploited in the wild.

**How severe is CVE-2026-15682?** Medium severity, with a CVSS score of 4.7, published 13 July 2026.

**Which products and versions are affected?** AnyDesk 9.0.4.

**Is there a fix for CVE-2026-15682?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15682 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-15682?** Check whether you run AnyDesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A link following vulnerability (CWE-59) exists within the 'Send Support Information' feature of AnyDesk version 9.0.4. The flaw stems from improper validation of file paths when the service handles support data, allowing a local attacker with low privileges to create directory junctions. By redirecting file operations via these junctions, the attacker can force the high-privileged AnyDesk service to create arbitrary files on the filesystem. This capability can be leveraged to cause a denial-of-service (DoS) condition. The attack requires local code execution and faces high architectural complexity (AC:H) to successfully time the junction creation.

## Affected products

- AnyDesk AnyDesk 9.0.4

## Timeline

- 2025-03-30: disclosed: Vulnerability reported to vendor
- 2026-07-08: advisory: Coordinated public release of advisory by Zero Day Initiative
- 2026-07-13: other: NVD publication date

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-401/](https://www.zerodayinitiative.com/advisories/ZDI-26-401/)

## Related threats

- [AnyDesk heap buffer overflow in session protocol mode 5](https://junglewise.ai/threats/cve-2026-109390-anydesk-before-8-0-3-allows-unauthenticated-remote-attackers-to)
- [AnyDesk link following denial of service in screen recording](https://junglewise.ai/threats/cve-2026-15681-anydesk-link-following-denial-of-service-in-screen-recording)
- [AnyDesk unquoted service path in AnyDesk Service](https://junglewise.ai/threats/cve-2016-20094-anydesk-unquoted-service-path-in-anydesk-service)
- [AnyDesk 5.4.0 contains an unquoted service path vulnerability in its Windows service configuration that allows local…](https://junglewise.ai/threats/cve-2019-25261-anydesk-5-4-0-contains-an-unquoted-service-path-vulnerability-in)
- [An issue was discovered in AnyDesk through 9.0.4. A remotely connected user with the "Control my device" permission…](https://junglewise.ai/threats/cve-2025-27919-an-issue-was-discovered-in-anydesk-through-9-0-4-a-remotely)