CVE-2026-81572: CodeMeter Runtime Privilege Escalation

CVE-2026-81572 Overview

CVE-2026-81572 is a local privilege escalation vulnerability in WIBU Systems CodeMeter Runtime. The cmu.exe utility creates a predictable temporary file at C:\CM-Stick when invoked with the --create-io --file C: arguments. The application fails to validate NTFS reparse points such as junctions or symbolic links before performing file operations. A local attacker can plant a junction that redirects the write or delete operation to an arbitrary path. Because CodeMeter Runtime executes with SYSTEM privileges, this link-following flaw enables arbitrary file deletion as SYSTEM and can be chained into full local privilege escalation. The weakness is tracked as [CWE-59] (Improper Link Resolution Before File Access).

Critical Impact
A local, low-privileged user can delete arbitrary files with SYSTEM privileges and escalate to SYSTEM on affected Windows hosts.

Affected Products

WIBU Systems CodeMeter Runtime (cmu.exe command-line utility)
Windows installations running CodeMeter Runtime as a SYSTEM service
Refer to the WIBU Security Advisory 103081 for exact affected version ranges

Discovery Timeline

2026-08-27 - CVE-2026-81572 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-81572

Vulnerability Analysis

The vulnerability resides in the temporary-file handling routine used by cmu.exe when invoked with --create-io --file C:. The utility writes a temporary file to the predictable path C:\CM-Stick. Because the parent directory is writable by unprivileged users and the target filename is deterministic, an attacker can win the race to create the path first. The CodeMeter service performs the file operation without checking whether the path contains an NTFS reparse point. Windows then follows the junction to a target chosen by the attacker.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. CodeMeter Runtime does not open the temporary file with flags such as FILE_FLAG_OPEN_REPARSE_POINT and does not verify that intermediate directory components are trusted. The service also operates in a user-writable directory instead of a protected location such as %SystemRoot%\Temp with a restricted ACL.

Attack Vector

An authenticated local attacker with standard user rights places an NTFS junction at C:\CM-Stick that points to a sensitive file, for example a DLL loaded by a SYSTEM service. The attacker then triggers cmu.exe --create-io --file C:. CodeMeter Runtime, running as SYSTEM, follows the junction and deletes or overwrites the target file. Arbitrary file deletion as SYSTEM is a well-established primitive for local privilege escalation on Windows and can be converted into code execution using published techniques. See the ShellTrail Local Privilege Escalation Research for exploitation details.

Detection Methods for CVE-2026-81572

Indicators of Compromise

Creation of the path C:\CM-Stick as an NTFS junction or symbolic link by a non-SYSTEM process.
Unexpected execution of cmu.exe with the arguments --create-io --file C: from a user session.
File deletion or modification events on protected paths where the acting process is a CodeMeter Runtime service running as SYSTEM.

Detection Strategies

Monitor process-creation telemetry for cmu.exe invocations that include the --create-io flag from interactive or low-privilege sessions.
Alert on reparse-point creation (IO_REPARSE_TAG_MOUNT_POINT, IO_REPARSE_TAG_SYMLINK) inside C:\CM-Stick or other user-writable roots that are subsequently accessed by a SYSTEM service.
Correlate SYSTEM-context file deletions in System32, driver directories, or service-hosted DLL paths with prior junction-creation events by unprivileged users.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 1 (process create), 11 (file create), and 23 (file delete) with rules targeting cmu.exe and reparse-point activity.
Forward endpoint telemetry to a centralized data lake to hunt for the junction-then-trigger pattern across hosts.
Baseline legitimate CodeMeter administrative usage so anomalous cmu.exe invocations by standard users stand out.

How to Mitigate CVE-2026-81572

Immediate Actions Required

Apply the vendor update referenced in the WIBU Security Advisory 103081 to all systems running CodeMeter Runtime.
Restrict local logon and interactive access on hosts running CodeMeter to trusted administrative users until patched.
Audit hosts for the presence of C:\CM-Stick as a reparse point and remove any unexpected junctions.

Patch Information

WIBU Systems has published fixed CodeMeter Runtime builds through Advisory 103081. Consult the advisory for the specific fixed version numbers and platform packages. The patched code validates reparse-point metadata before performing file operations and moves the temporary artifact to a protected location.

Workarounds

Block or restrict execution of cmu.exe for non-administrative users via AppLocker or Windows Defender Application Control.
Pre-create C:\CM-Stick as a directory with an ACL that denies write and reparse-point creation to standard users.
Disable the CodeMeter service on hosts that do not require license-container functionality.

bash

# Pre-create C:\CM-Stick with restrictive ACL to block junction planting (run as Administrator)
mkdir C:\CM-Stick
icacls C:\CM-Stick /inheritance:r
icacls C:\CM-Stick /grant:r SYSTEM:(OI)(CI)F Administrators:(OI)(CI)F
icacls C:\CM-Stick /deny "Authenticated Users":(OI)(CI)(WD,AD,WA)