HIGH 7.8 NVD
CVE-2026-81572
cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse poi
cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and
file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file
operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary
system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted
with System privileges and potentially enable local privilege escalation.
References
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103081.pdf
- https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codem
This high severity vulnerability with a CVSS score of 7.8 was published on 2026-08-27 via NVD.
vulnfeed aggregates 11337 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.