Is CVE-2026-81579 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81579 being exploited in the wild.

How severe is CVE-2026-81579?

High severity, with a CVSS score of 8.8, published 27 August 2026.

Which products and versions are affected?

Wibu-Systems WibuKey before 6.71.

Is there a fix for CVE-2026-81579?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-81579 attacked?

It is attacked with local access.

Am I affected by CVE-2026-81579?

Check whether you run Wibu-Systems WibuKey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81579: Wibu-Systems WibuKey kernel driver privilege escalation

CVE-2026-81579 · Severity: high · CVSS 8.8 · Published 2026-08-27

WibuKey is a software protection and licensing dongle used to prevent unauthorized software distribution. A flaw in the 64-bit Windows kernel driver allows a local attacker to write arbitrary values to memory, leading to privilege escalation and complete system takeover with administrator privileges. Affected users could lose control of their systems or have malware installed by attackers.

Vendors: Wibu-Systems.

Quick answers

Is CVE-2026-81579 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81579 being exploited in the wild.
How severe is CVE-2026-81579?: High severity, with a CVSS score of 8.8, published 27 August 2026.
Which products and versions are affected?: Wibu-Systems WibuKey before 6.71.
Is there a fix for CVE-2026-81579?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81579 attacked?: It is attacked with local access.
Am I affected by CVE-2026-81579?: Check whether you run Wibu-Systems WibuKey at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows systems, affecting versions before 6.71. This flaw enables a write-what-where primitive that allows local attackers to write arbitrary data to arbitrary memory locations. An attacker with local system access can exploit this to escalate privileges to SYSTEM level, execute arbitrary kernel-mode code, or launch a shell with administrator rights. Mitigation requires upgrading to version 6.71 or later.

Affected products

Wibu-Systems WibuKey before 6.71

Timeline

2026-08-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.