Is CVE-2026-81573 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81573 being exploited in the wild.

How severe is CVE-2026-81573?

High severity, with a CVSS score of 8.6, published 27 August 2026.

Which products and versions are affected?

Wibu-Systems CodeMeter Runtime before 8.41a and before 9.10.

Is there a fix for CVE-2026-81573?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-81573 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-81573?

Check whether you run Wibu-Systems CodeMeter Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81573: Wibu-Systems CodeMeter Runtime network-origin bypass in configuration handler

CVE-2026-81573 · Severity: high · CVSS 8.6 · Published 2026-08-27

CodeMeter Runtime is license management software deployed on computers to enable protected applications. When configured as a server, it accepts configuration commands without properly validating that they originate from authorized local or same-network clients. An attacker on the internet can send crafted commands to read sensitive configuration data, modify server settings, and crucially, obtain or reset credentials for the CodeMeter WebAdmin interface—enabling complete administrative takeover of the licensing system.

Technologies: Wibu-Systems CodeMeter Runtime. Vendors: Wibu-Systems.

Quick answers

Is CVE-2026-81573 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81573 being exploited in the wild.
How severe is CVE-2026-81573?: High severity, with a CVSS score of 8.6, published 27 August 2026.
Which products and versions are affected?: Wibu-Systems CodeMeter Runtime before 8.41a and before 9.10.
Is there a fix for CVE-2026-81573?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81573 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-81573?: Check whether you run Wibu-Systems CodeMeter Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a network-origin validation bypass in the configuration command handler of CodeMeter Runtime when operating in server mode. The affected component fails to enforce network-origin restrictions on configuration commands, allowing arbitrary remote peers to execute operations intended only for local or trusted network clients. An attacker can read potentially sensitive configuration data stored in Server.ini, overwrite selected configuration values, and extract or modify the hash of WebAdmin credentials. This requires network access to the CodeMeter Runtime service port but does not require prior authentication or user interaction. The vulnerability affects versions before 8.41a and 9.10; fixes are available in those versions and later.

Affected products

Wibu-Systems CodeMeter Runtime before 8.41a and before 9.10

Timeline

2026-08-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.