CVE-2026-39031 Overview
CVE-2026-39031 affects Lansweeper lsrunase 2.0 and lsencrypt 2.0. Both utilities protect credentials using RC4 encryption with a hardcoded 142-byte static key array. An 8-character prefix sits in cleartext alongside the ciphertext. A local attacker can recover any encrypted password to plaintext using a single SHA-1 hash and one RC4 decryption operation. No brute force or key discovery is required. The flaw maps to CWE-321: Use of Hard-coded Cryptographic Key.
Critical Impact
Any local user with access to stored credential blobs can decrypt Lansweeper-managed passwords to plaintext instantly, exposing service and administrative accounts.
Affected Products
- Lansweeper lsrunase 2.0
- Lansweeper lsencrypt 2.0
Discovery Timeline
- 2026-06-26 - CVE-2026-39031 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-39031
Vulnerability Analysis
The lsrunase and lsencrypt utilities encrypt credentials using the RC4 stream cipher. Both utilities embed a 142-byte static key array directly in the binary. The key is identical across all installations and does not derive from any per-user or per-machine secret. When encrypting a credential, the utilities prepend an 8-character prefix stored in cleartext next to the resulting ciphertext. Decryption requires only a single SHA-1 hash operation over known material followed by RC4 decryption using the embedded key. An attacker who obtains an encrypted credential blob can therefore recover the plaintext password in constant time. The vulnerability requires local access with low privileges but yields high confidentiality impact on any credentials protected by these utilities.
Root Cause
The root cause is the use of a hardcoded cryptographic key [CWE-321] embedded in the utility binaries. RC4, already deprecated for security-sensitive use, combined with a static key that does not vary per installation, provides no cryptographic protection against a knowledgeable attacker. Reversing the utility once yields the key material needed to decrypt every deployment.
Attack Vector
An attacker with local access to a host where Lansweeper stores encrypted credentials extracts the ciphertext blob and its 8-character cleartext prefix. The attacker applies SHA-1 to derive the working key state, then runs RC4 decryption using the extracted 142-byte key array. The output is the plaintext credential. Public proof-of-concept material is available in the GitHub PoC Repository and the Usermode CVE Analysis PDF.
Detection Methods for CVE-2026-39031
Indicators of Compromise
- Presence of lsrunase.exe or lsencrypt.exe version 2.0 binaries on managed hosts.
- Encrypted credential files or registry values containing an 8-character cleartext prefix followed by RC4 ciphertext.
- Unexpected read access to Lansweeper credential storage locations by non-administrative processes.
Detection Strategies
- Inventory endpoints for the vulnerable lsrunase 2.0 and lsencrypt 2.0 binaries by hash and file version.
- Monitor for processes that enumerate or copy Lansweeper credential blobs outside expected administrative workflows.
- Alert on execution of the affected utilities by users or contexts that do not normally invoke them.
Monitoring Recommendations
- Enable file access auditing on directories and registry keys that hold Lansweeper-encrypted credentials.
- Correlate credential blob access events with subsequent authentication activity for the affected service accounts.
- Track outbound transfers of files matching the encrypted credential format from managed hosts.
How to Mitigate CVE-2026-39031
Immediate Actions Required
- Identify all systems running Lansweeper lsrunase 2.0 or lsencrypt 2.0 and inventory credentials protected by these utilities.
- Rotate every password ever encrypted by the affected utilities, prioritizing domain, service, and administrative accounts.
- Restrict local access to hosts that store the encrypted credential blobs to trusted administrators only.
Patch Information
At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2026-39031. Consult the Usermode CVE Analysis PDF and Lansweeper vendor communications for updated remediation guidance. Replace hardcoded-key credential storage with vendor-supplied alternatives that derive keys from per-installation or DPAPI-protected material.
Workarounds
- Avoid storing high-value credentials with lsrunase 2.0 or lsencrypt 2.0 until a fixed release is available.
- Use operating system credential vaults such as Windows DPAPI or a dedicated secrets manager for accounts previously handled by these utilities.
- Apply least-privilege access controls and full-disk encryption to reduce the attack surface exposed to local users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
