CVE-2026-81573: Improper Access Control in Local-Only Configuration Commands
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
The issue affects CodeMeter Runtime deployments configured as a server, in versions before 8.41a or 9.10. The provided information does not indicate that non-server configurations are affected.
What does an attacker need to exploit this issue?
An attacker can exploit the affected configuration command handler remotely as an arbitrary network peer. No privileges or user interaction are required.
What could an attacker do after exploiting it?
An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This includes the CodeMeter WebAdmin credential hash, which can enable takeover of WebAdmin.