CVE-2026-81576 Overview
CVE-2026-81576 is an authorization bypass vulnerability in Wibu-Systems CodeMeter Runtime when configured as a server. Versions before 8.41a and 9.10 issue handles per connection and rely on a cryptographically weak Session Identifier (SID) as the sole authenticator. An attacker with network access and low privileges can brute-force the SID, recover another session's handle number, and read license information belonging to that handle. The flaw maps to [CWE-639]: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated network attackers can enumerate weak SIDs to hijack session handles and disclose license data belonging to other users of the CodeMeter server.
Affected Products
- Wibu-Systems CodeMeter Runtime versions prior to 8.41a (8.x branch)
- Wibu-Systems CodeMeter Runtime versions prior to 9.10 (9.x branch)
- Deployments where CodeMeter Runtime is configured in server mode
Discovery Timeline
- 2026-08-27 - CVE-2026-81576 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-81576
Vulnerability Analysis
CodeMeter Runtime is a licensing and digital rights management service from Wibu-Systems. When deployed in server mode, it serves license handles to remote client processes over the network. Each client connection receives a handle number and a Session Identifier used to authorize subsequent operations against that handle.
The vulnerability stems from the SID being generated with insufficient cryptographic strength. Because the SID is the sole authenticator for a handle, an attacker who can guess or brute-force the SID gains the same access as the legitimate session owner. The scope changes from the attacker's own session to another user's session, which is reflected in the changed scope of the CVSS vector.
Exploitation results in disclosure of license information tied to handles owned by other clients. Integrity and availability are not directly affected, but leaked license data can enable secondary attacks or intellectual property exposure.
Root Cause
The SID acts as a bearer token but is generated using a weak scheme that does not provide sufficient entropy to resist offline or online brute-force enumeration. Because the handle number and SID together grant full authorization, no additional binding to the connecting client, source address, or authenticated identity is enforced.
Attack Vector
An attacker with network reachability to the CodeMeter server and the ability to open a connection iterates candidate SID values against known or guessed handle numbers. Successful guesses return license information associated with the victim session. No user interaction is required. Refer to the Wibu Security Advisory WIBU-103401 for protocol-level details.
Detection Methods for CVE-2026-81576
Indicators of Compromise
- High volumes of CodeMeter server requests from a single client with sequential or randomized SID values.
- Repeated authorization failures against the CodeMeter service (default TCP port 22350) preceding a successful license query.
- Unexpected license read operations from client sessions that did not originate from a legitimate license consumer.
Detection Strategies
- Monitor CodeMeter Runtime logs for rapid, iterative handle or SID probing patterns.
- Correlate network flows to TCP 22350 and identify sources issuing anomalous request rates.
- Alert on CodeMeter clients connecting from network segments that do not host licensed applications.
Monitoring Recommendations
- Enable verbose CodeMeter server logging and forward events to a centralized SIEM for retention and correlation.
- Baseline normal license query volumes per host and alert on deviations that suggest SID brute-forcing.
- Track CodeMeter Runtime version inventory across the estate to identify hosts still running vulnerable builds.
How to Mitigate CVE-2026-81576
Immediate Actions Required
- Upgrade CodeMeter Runtime to version 8.41a or 9.10 or later on all servers and clients.
- Restrict network access to the CodeMeter server port (22350) using firewalls to trusted license consumers only.
- Audit CodeMeter server logs for evidence of SID enumeration or unauthorized license reads.
Patch Information
Wibu-Systems addresses the weak SID authentication in CodeMeter Runtime 8.41a and 9.10. Details and download locations are provided in the Wibu Security Advisory WIBU-103401.
Workarounds
- Where patching is not immediately possible, bind CodeMeter Runtime to localhost on hosts that do not require remote licensing.
- Place CodeMeter servers on isolated management VLANs and require VPN or zero-trust network access for clients.
- Disable server mode on endpoints that only need standalone or client licensing.
# Example: restrict inbound access to CodeMeter server port on Linux
sudo iptables -A INPUT -p tcp --dport 22350 -s 10.20.30.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22350 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
