CVE-2026-15682: AnyDesk Link Following DoS Vulnerability

CVE-2026-15682 Overview

CVE-2026-15682 is a link following vulnerability in AnyDesk that enables local attackers to trigger a denial-of-service condition on affected systems. The flaw resides in the Send Support Information feature, which fails to properly validate filesystem junctions before writing files. An attacker with the ability to execute low-privileged code on the target host can abuse the AnyDesk service to create arbitrary files at attacker-controlled locations. This file creation primitive allows disruption of system operation and denial of service. The issue was reported through the Zero Day Initiative as ZDI-CAN-26645 and is tracked as [CWE-59] Improper Link Resolution Before File Access.

Critical Impact
A local low-privileged attacker can abuse the AnyDesk service to create arbitrary files through junction abuse, resulting in a denial-of-service condition on the affected host.

Affected Products

AnyDesk 9.0.4 on Windows
AnyDesk installations exposing the Send Support Information feature
Systems where the AnyDesk service runs with elevated privileges

Discovery Timeline

2026-07-13 - CVE-2026-15682 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15682

Vulnerability Analysis

The vulnerability exists in the AnyDesk Send Support Information feature. This feature is intended to bundle diagnostic data for support requests and write output files to disk on behalf of the user. The service performs file operations without adequately verifying that target paths are legitimate files rather than filesystem junctions or symbolic links. Because the AnyDesk service operates at a higher privilege level than the invoking user, an attacker who controls the destination path through a junction can direct file creation to protected locations. The resulting arbitrary file write leads to a denial-of-service condition. Confidentiality and integrity of the system are not directly affected by this specific flaw, but availability can be disrupted through targeted overwrites or resource corruption.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. The Send Support Information code path resolves file destinations without canonicalizing paths or rejecting reparse points. When the service opens or creates a file at a path controlled by a low-privileged user, it follows any junction present in the path chain. This TOCTOU-style oversight allows redirection of privileged file operations to sensitive locations.

Attack Vector

Exploitation requires local access and the ability to run low-privileged code on the target system. The attacker first stages a directory that the AnyDesk service will write into, then replaces it with a junction pointing to an attacker-chosen filesystem location. When the Send Support Information feature is invoked, the service follows the junction and creates a file at the redirected path with service-level privileges. The attacker leverages this arbitrary file creation primitive to overwrite or fabricate files needed for system stability, producing the denial-of-service outcome. No user interaction beyond the attacker's own actions is required.

Refer to the Zero Day Initiative Advisory ZDI-26-401 for additional technical context.

Detection Methods for CVE-2026-15682

Indicators of Compromise

Creation of NTFS junctions or reparse points within directories used by AnyDesk for support bundle output
Unexpected files appearing in system-protected directories with timestamps aligned to AnyDesk service activity
AnyDesk service process (AnyDesk.exe running as a service) writing files outside its normal working directories

Detection Strategies

Monitor file system minifilter events for FSCTL_SET_REPARSE_POINT operations issued by non-administrative users in paths later accessed by AnyDesk
Alert on the AnyDesk service handling files whose canonical path differs from the requested path, indicating junction traversal
Correlate invocations of the Send Support Information feature with subsequent file writes to sensitive directories

Monitoring Recommendations

Enable Windows object access auditing on directories where AnyDesk stages support information output
Ingest Sysmon Event ID 11 (File Create) and Event ID 15 (File Stream Created) filtered on the AnyDesk service account
Track service crashes, process termination, and system stability events immediately following AnyDesk support workflows

How to Mitigate CVE-2026-15682

Immediate Actions Required

Upgrade AnyDesk to a version later than 9.0.4 once a fixed release is published by the vendor
Restrict which local users can invoke the Send Support Information feature on managed endpoints
Audit and remove existing junctions in AnyDesk working directories that were not created by the service itself

Patch Information

At the time of publication, no vendor patch URL is listed in the NVD entry. Administrators should monitor the Zero Day Initiative Advisory ZDI-26-401 and the AnyDesk vendor security channel for release notes addressing this issue. Apply the vendor-supplied update as soon as it becomes available.

Workarounds

Limit AnyDesk installation to systems that require remote support and remove it from general-purpose workstations where feasible
Enforce Windows Group Policy restrictions preventing standard users from creating symbolic links or junctions (SeCreateSymbolicLinkPrivilege)
Configure endpoint protection to block untrusted processes from modifying AnyDesk's staging directories

bash

# Example: remove SeCreateSymbolicLinkPrivilege from standard users on Windows
# Export current local security policy
secedit /export /cfg C:\secpol.cfg

# Edit C:\secpol.cfg and ensure SeCreateSymbolicLinkPrivilege
# is assigned only to Administrators, then reapply:
secedit /configure /db C:\Windows\security\local.sdb /cfg C:\secpol.cfg /areas USER_RIGHTS