CVE-2026-15682

AnyDesk Support Information Link Following Denial-of-Service Vulnerability

State
Published
Severity
4.7 Medium
Published
Jul 13, 2026
Updated
Jul 14, 2026
Reserved
Jul 13, 2026

Read the record on cve.org

Description

AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Send Support Information feature. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26645.

Scores

CVSSScoreVectorSource
3.04.7 MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:Hzdi

Weaknesses

  • CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

ProductVersions
AnyDeskAnyDesk
  • 9.0.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.