CVE-2026-109390 is an unauthenticated remote-code-execution flaw in AnyDesk for Linux that can run commands as root before the person at the other end approves desktop control. That matters because AnyDesk is remote-desktop and support software: internal IT teams, help desks and managed service providers use it to administer endpoints, while schools, manufacturers, healthcare organisations and public-sector teams may use it to support distributed devices.
The official affected range is Linux AnyDesk 8.0.0 through 8.0.2; version 8.0.3 is fixed. The CVE was published after the fix, and its structured record identifies the underlying weakness as CWE-130, improper handling of inconsistent length parameters, rather than a generic buffer-overflow classification.
A session packet reaches memory before approval
AnyDesk's session protocol handles packets used to establish and operate remote connections. In its mode-5 stream-packet handler, a payload-length value is not properly validated before it is used in a memory operation. A remote peer can send a crafted packet whose declared length does not match safe allocation or copy boundaries, overflowing heap memory — dynamically allocated memory used by the running process.
The consequence demonstrated by researchers is not merely a crash. Their public AnyPwn exploit targets 64-bit Linux AnyDesk 8.0.2 running in service mode and reachable directly on TCP port 7070, achieving command execution as root without interactive session approval. Exploitation is build-specific and probabilistic: failed attempts may crash the service instead. The published technical material says other builds require different offsets, so public working exploitation has only been demonstrated for 8.0.2, not separately for 8.0.0 or 8.0.1.
Researchers also reached the vulnerable protocol path through AnyDesk relays while instrumenting it, but did not publish a complete relay-based RCE demonstration. AnyDesk's reported position is that the issue is limited to direct Linux connections. Teams should treat relay-path exploitation as unconfirmed rather than assuming either that relays are safe or that the public exploit proves they are vulnerable.
Patch first, then reduce the reachable surface
AnyDesk released Linux 8.0.3 on June 23, 2026; its changelog describes the change only as a crash-causing bug fix, without naming this CVE or describing the security impact. Upgrade every Linux deployment in the documented affected range to 8.0.3 or a later release. Inventory unattended and service-mode installations especially carefully: they are the deployments most likely to listen for remote support when no user is present to notice a connection.
Until upgrades are verified, remove unnecessary direct exposure of TCP 7070, restrict access with network policy or VPN controls, and review which hosts run AnyDesk as root. Network segmentation and egress monitoring are useful compensating controls, but neither replaces the patch when an attacker can directly reach the service.
A public exploit, but no confirmed campaign
A public proof of concept exists, but as of October 18, 2026 there was no confirmed in-the-wild exploitation, named victim, or campaign tied to CVE-2026-109390. It is also absent from CISA's KEV catalogue; available evidence is classified as proof-of-concept activity, not active exploitation.
For organisations that rely on remote support to keep endpoints, production systems or public services running, this is a straightforward patch-and-exposure problem with unusually high privileges at stake. SecAlerts monitors an organisation's actual software stack and alerts on new vulnerabilities affecting the products it runs, which helps ensure remote-access software does not become an overlooked exception.
