CVE-2026-15681: AnyDesk Screen Recording DoS Vulnerability

CVE-2026-15681 Overview

CVE-2026-15681 is a link-following vulnerability in AnyDesk that allows a local, low-privileged attacker to trigger a denial-of-service condition. The flaw resides in how the AnyDesk service handles screen recording files. An attacker who can execute code on the target system can abuse a directory junction to coerce the service into creating arbitrary files in unintended locations. The Zero Day Initiative tracked this issue as ZDI-CAN-26591 and published advisory ZDI-26-400. The vulnerability is categorized under [CWE-59] (Improper Link Resolution Before File Access, or 'Link Following').

Critical Impact
A local low-privileged attacker can leverage a filesystem junction to force the elevated AnyDesk service to create arbitrary files, resulting in a denial-of-service condition on the affected host.

Affected Products

AnyDesk 9.0.4
AnyDesk installations exposing the screen recording service component
Windows systems running the vulnerable AnyDesk version

Discovery Timeline

2026-07-13 - CVE-2026-15681 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15681

Vulnerability Analysis

The vulnerability stems from insecure file handling within the AnyDesk service that manages screen recording output. The service performs file creation operations without properly validating whether the target path resolves through a symbolic link or NTFS junction. A local attacker with limited privileges can prepare a crafted junction on the filesystem, then trigger the recording workflow so the service writes to attacker-chosen locations.

Because the service runs with higher privileges than the attacker, arbitrary file creation in protected directories becomes possible. The resulting impact is limited to availability. The attacker cannot directly read or modify existing file contents through this flaw, but can render the system or specific components unusable by overwriting or planting files that disrupt normal operation.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. The AnyDesk service fails to canonicalize the target path or validate that intermediate directory components are not junctions or reparse points before performing privileged file operations. This class of flaw is common in Windows services that operate on user-controlled paths without impersonating the requesting user during I/O.

Attack Vector

Exploitation requires local access and the ability to execute low-privileged code. No user interaction is needed. The attacker first plants a junction that redirects a directory used by the screen recording feature to a sensitive location on disk. When the AnyDesk service subsequently writes a screen recording file, the write is redirected through the junction. The service, running with elevated rights, creates a file at the attacker-controlled destination, producing a denial-of-service outcome.

See the Zero Day Initiative Advisory ZDI-26-400 for the technical writeup.

Detection Methods for CVE-2026-15681

Indicators of Compromise

Unexpected files appearing in system directories with timestamps that correlate with AnyDesk service activity.
Presence of NTFS junctions or reparse points inside AnyDesk working directories, particularly under paths used for screen recording output.
AnyDesk service errors or crashes tied to file I/O operations on non-standard paths.

Detection Strategies

Monitor process file creation events where the AnyDesk service (AnyDesk.exe running as SYSTEM or LocalService) writes to directories outside its normal working paths.
Alert on creation of reparse points or junctions by low-privileged user processes that target directories consumed by privileged services.
Correlate low-privileged user activity with subsequent privileged file writes to detect junction-based redirection patterns.

Monitoring Recommendations

Enable Windows Sysmon Event ID 11 (FileCreate) and Event ID 27 (FileBlockExecutable) with rules covering AnyDesk service paths.
Track Event ID 4663 (object access) on directories used by AnyDesk for recording output.
Review AnyDesk service logs for repeated file write failures or unusual output paths tied to screen recording sessions.

How to Mitigate CVE-2026-15681

Immediate Actions Required

Inventory all endpoints running AnyDesk 9.0.4 and prioritize them for update to a fixed release.
Restrict interactive logon and low-privileged code execution on hosts where AnyDesk runs as a privileged service.
Disable the screen recording feature via AnyDesk configuration where operational requirements permit.

Patch Information

Refer to the vendor advisory and the Zero Day Initiative Advisory ZDI-26-400 for the fixed version of AnyDesk. Upgrade all affected installations to the vendor-supplied release that addresses the link-following flaw in the screen recording component.

Workarounds

Remove write permissions from the AnyDesk recording output directory for standard users to prevent junction planting.
Configure AnyDesk to store recordings in a directory whose parent path is not writable by non-administrative users.
Apply application control policies that restrict which processes can create reparse points on managed endpoints.

bash

# Windows: audit and remove junctions in AnyDesk working directories
dir /AL "%ProgramData%\AnyDesk" /S
fsutil reparsepoint query "C:\ProgramData\AnyDesk\<suspect_path>"
fsutil reparsepoint delete "C:\ProgramData\AnyDesk\<suspect_path>"