# CVE-2026-81576: Wibu-Systems CodeMeter Runtime cryptographic weakness in handle authentication

Source: https://junglewise.ai/threats/cve-2026-81576-wibu-systems-codemeter-runtime-cryptographic-weakness-in-handle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81576 · Severity: high · CVSS 7.7 · Published 2026-08-27

CodeMeter Runtime is a licensing and software protection system used to manage and validate software licenses across computers and networks. When configured as a server, the software uses a weak cryptographic method to authenticate session handles, allowing attackers to forge authentication credentials and access license information belonging to other users or systems without proper authorization.

Technologies: [Wibu-Systems CodeMeter Runtime](https://junglewise.ai/threats/technologies/codemeter-runtime). Vendors: [Wibu-Systems](https://junglewise.ai/threats/vendors/wibu-systems).

## Quick answers

**Is CVE-2026-81576 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81576 being exploited in the wild.

**How severe is CVE-2026-81576?** High severity, with a CVSS score of 7.7, published 27 August 2026.

**Which products and versions are affected?** Wibu-Systems CodeMeter Runtime before 8.41a and 9.10.

**Is there a fix for CVE-2026-81576?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-81576 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-81576?** Check whether you run Wibu-Systems CodeMeter Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

When CodeMeter Runtime operates in server mode, it assigns per-connection session identifiers (SIDs) that serve as the sole authentication mechanism for handle authorization. The SIDs are generated using a cryptographically weak algorithm, making them susceptible to brute-force attacks. An unauthenticated attacker on the network can enumerate valid SID values, recover another session's handle number, and access license information associated with that handle. The vulnerability requires the Runtime to be configured as a server and network connectivity to the Runtime Service; no user interaction is required. Fixed in versions 8.41a and 9.10.

## Affected products

- Wibu-Systems CodeMeter Runtime before 8.41a and 9.10

## Timeline

- 2026-08-27: disclosed

## References

- [https://www.wibu.com/products/codemeter/runtime.html](https://www.wibu.com/products/codemeter/runtime.html)
- [https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf](https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf)

## Related threats

- [Wibu-Systems CodeMeter Runtime buffer over-read in server mode](https://junglewise.ai/threats/cve-2026-81575-wibu-systems-codemeter-runtime-buffer-over-read-in-server-mode)
- [Wibu-Systems CodeMeter Runtime format string injection](https://junglewise.ai/threats/cve-2026-81574-wibu-systems-codemeter-runtime-format-string-injection)
- [Wibu-Systems CodeMeter Runtime network-origin bypass in configuration handler](https://junglewise.ai/threats/cve-2026-81573-wibu-systems-codemeter-runtime-network-origin-bypass-in)
- [Wibu-Systems CodeMeter Runtime insecure temporary file in cmu.exe](https://junglewise.ai/threats/cve-2026-81572-wibu-systems-codemeter-runtime-insecure-temporary-file-in-cmu-exe)