AnyDesk "Send Support Information" Link-Following Denial-of-Service (CVE-2026-15682)

Key facts for AnyDesk Send Support Information DoS

Detection coverage for AnyDesk Send Support Information DoS

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1423 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AnyDesk Diagnostic/Recording Write Immediately Following Reparse-Point Creation (Redirect Confirmation)

Correlates a junction/reparse-point creation event with a subsequent AnyDesk.exe file-write to the same path within a short window — the core CWE-59 link-following redirect that turns a benign diagnostic export or screen recording into an out-of-bounds write against CVE-2026-15682/CVE-2026-15681.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1222.001, T1499.004
• Data sources: sysmon, windows_filesystem_auditing
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11)
| eval etype=if(EventCode=1,"process","filewrite")
| eval is_junction=if(etype="process" AND (match(CommandLine,"(?i)mklink.*\/J") OR match(CommandLine,"(?i)reparsepoint")),1,0)
| eval is_anydesk_write=if(etype="filewrite" AND match(Image,"(?i)anydesk\.exe"),1,0)
| stats earliest(eval(if(is_junction=1,_time,null()))) as junction_time latest(eval(if(is_anydesk_write=1,_time,null()))) as write_time values(TargetFilename) as target_paths by host
| where isnotnull(junction_time) AND isnotnull(write_time) AND (write_time - junction_time) >= 0 AND (write_time - junction_time) <= 300
| table host, junction_time, write_time, target_paths

Microsoft KQL

let junctions = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("mklink", "reparsepoint") and ProcessCommandLine has "/J"
| project DeviceName, JunctionTime = Timestamp, JunctionCmd = ProcessCommandLine;
let anydeskWrites = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "AnyDesk.exe"
| project DeviceName, WriteTime = Timestamp, FileName, FolderPath;
junctions
| join kind=inner (anydeskWrites) on DeviceName
| where WriteTime between (JunctionTime .. JunctionTime + 5m)
| project DeviceName, JunctionTime, JunctionCmd, WriteTime, FileName, FolderPath

Sigma

title: AnyDesk File Write Shortly After Reparse Point Creation (Link-Following Redirect)
id: 8f1c6a2e-1423-4c00-9a11-anydesk-cwe59
status: experimental
description: Detects an AnyDesk.exe file write occurring within 5 minutes of a junction/reparse point creation, consistent with successful CWE-59 link-following exploitation of CVE-2026-15682/CVE-2026-15681.
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-26-401/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15682
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.defense-evasion
    - attack.t1222.001
    - attack.impact
    - attack.t1499.004
    - cve.2026.15682
    - cve.2026.15681
logsource:
    category: process_creation
    product: windows
detection:
    selection_junction:
        Image|endswith:
            - '\cmd.exe'
            - '\fsutil.exe'
        CommandLine|contains:
            - 'mklink /J'
            - 'reparsepoint'
    selection_writer:
        Image|endswith: '\AnyDesk.exe'
    timeframe: 5m
    condition: selection_junction and selection_writer
falsepositives:
    - Legitimate deduplication/backup tooling that also uses junctions
level: high

Known false positives:

• Coincidental unrelated junction creation and AnyDesk activity within the same 5-minute window on busy IT help-desk endpoints

Tuning notes: Narrow the correlation window from 5 minutes if false positives are high on shared jump boxes; add file-hash/target-path allowlisting for known-legitimate AnyDesk export directories.

• 🔒 Repeated Reparse-Point Probing Across Candidate Output Directories (Junction Race Staging) · unlock with TL Creds
• 🔒 Remote-Support Process Write to System-Adjacent Path via Reparse Point · unlock with TL Creds
• 🔒 Vulnerability/Software Reconnaissance Targeting AnyDesk 9.0.4 Prior to Local Exploitation · unlock with TL Creds
• 🔒 AnyDesk Send Support Information Invocation Immediately Preceded by Junction Creation · unlock with TL Creds
• 🔒 AnyDesk Screen Recording Feature Write Redirected via Reparse Point (Sibling CVE-2026-15681) · unlock with TL Creds
• 🔒 Reparse-Point-Enabled Data Destruction Pattern Following Remote-Support Process Write · unlock with TL Creds
• 🔒 NTFS Junction/Reparse-Point Creation via mklink or fsutil (Exploitation Staging) · unlock with TL Creds
• 🔒 AnyDesk Service Crash or Unresponsiveness Following Support/Recording Feature Invocation (Impact Confirmation) · unlock with TL Creds

Indicators of compromise for AnyDesk Send Support Information DoS

As of 2026-07-16, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-1423.

How AnyDesk Send Support Information DoS works

CVE-2026-15682 affects AnyDesk's "Send Support Information" diagnostic-export feature in AnyDesk for Windows version 9.0.4. The feature collects and writes diagnostic data to disk without adequate validation or sanitization of the destination file paths. An attacker who already holds low-privileged local code execution on the target machine can pre-stage a filesystem junction (an NTFS reparse point, e.g. created with `mklink /J` or `fsutil reparsepoint`) pointing from an expected/writable path to a sensitive or critical location such as `C:\Windows\System32\drivers\etc`. When the higher-privileged AnyDesk process invokes the Send Support Information routine, it follows the junction rather than validating that the resolved target is the intended path, and writes attacker-influenced file content to the redirected location. This can overwrite or corrupt files the AnyDesk process would not otherwise be permitted or intended to touch, crashing the AnyDesk service or leaving the endpoint in an unresponsive state — a denial-of-service condition (CVSS Availability impact: High; Confidentiality and Integrity: None).

Exploitation is not remotely reachable: CVSS AV:L and PR:L mean the attacker must already have a local foothold, and the vendor CNA/ZDI scoring of AC:H reflects the timing/race-condition-style setup (creating the junction and inducing AnyDesk to traverse it) needed to reliably trigger the write. NVD's own re-scoring under AC:L (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) suggests some scoring disagreement between NIST and the reporting CNA (ZDI's CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7) on the practical difficulty of triggering the junction race, but both agree the flaw is a local-only DoS with no data exposure.

The vulnerability was reported to ZDI as ZDI-CAN-26645 on 2025-03-30 by Giuliano Sanfins of SiDi (handle 0x_alibabas). ZDI's zero-day disclosure process ran its course over roughly 15 months: a 0-day publication notice was sent to the vendor on 2026-06-26, the advisory was released publicly on 2026-07-08 and updated on 2026-07-13, coinciding with CVE-2026-15682's publication on NVD (2026-07-13, last modified 2026-07-14). ZDI's advisory states AnyDesk's support team determined the report fell outside the scope they intended to fix, so the vulnerability was disclosed without an available patch; third-party reporting (DailyCVE) projects a fix around 2026-08-03, but this is unconfirmed by the vendor.

This disclosure is one of at least two closely related link-following DoS flaws affecting AnyDesk 9.0.4 disclosed by the same researcher in the same window: CVE-2026-15681 affects the Screen Recording file-handling code path (ZDI-CAN-26591) via the same junction-abuse pattern (CWE-59), with an expected patch around 2026-07-27. The recurrence of link-following/reparse-point weaknesses in AnyDesk's file-handling code (a class of flaw AnyDesk has had before, e.g. 2024 wallpaper-handling/reparse-point privilege-escalation reports) is notable for defenders given AnyDesk's footprint as widely-deployed remote-access/remote-support software in IT help desks and MSP environments, and given AnyDesk's unrelated but reputationally significant February 2024 production breach (source code and code-signing certificate theft, forcing a certificate revocation and portal-wide password reset) that already elevated scrutiny of the vendor's software supply chain.

No public proof-of-concept exploit code and no confirmed active exploitation have been reported for CVE-2026-15682 as of this writing. Because exploitation requires an attacker to already have local low-privilege code execution, this flaw functions primarily as a post-compromise DoS/disruption or anti-forensics tool (crashing the very remote-access tool an incident responder might rely on) rather than an initial-access vector.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.001 PowerShell; T1106 Native API; T1203 Exploitation for Client Execution

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery

defense-impairment

T1222.001 Windows Permissions

Impact

T1485 Data Destruction; T1489 Service Stop; T1499.004 Application or System Exploitation

Resource Development

T1587.001 Malware; T1588.005 Exploits

Reconnaissance

T1592.002 Software; T1595.002 Vulnerability Scanning

Remediation for AnyDesk Send Support Information DoS

Patches

• No vendor patch is available for CVE-2026-15682 as of 2026-07-16; AnyDesk's support team reportedly deemed the report out of scope for a fix
• Sibling flaw CVE-2026-15681 (screen recording feature, same version/root cause) has a projected patch around 2026-07-27

Immediate actions

• Restrict which local accounts/processes can execute code on endpoints running AnyDesk, since exploitation requires prior low-privilege local code execution
• Disable or restrict use of the "Send Support Information" feature where it is not operationally required
• Monitor for anomalous creation of NTFS junctions/reparse points (via mklink /J or fsutil reparsepoint) in user-writable directories on endpoints running AnyDesk
• Monitor AnyDesk process crash/unresponsiveness events as a potential exploitation indicator, especially on IT help-desk and MSP jump systems

Workarounds

• Restrict interaction with the AnyDesk client to trusted, already-hardened endpoints until a patch is available (ZDI's stated interim mitigation)
• Remove or restrict filesystem permissions that allow low-privileged local users to create junctions in directories the AnyDesk support-information feature can write through

Longer-term hardening

• Apply the vendor patch once released (projected on/after 2026-08-03) for CVE-2026-15682 and the sibling CVE-2026-15681 fix (projected on/after 2026-07-27)
• Deploy EDR rules that flag reparse-point creation immediately followed by writes from a remote-access-tool process to unexpected system paths
• Enforce least-privilege on endpoints hosting remote-support tooling to reduce the value of local low-priv code execution as a stepping stone

Affected and fixed versions

• AnyDesk Software GmbH — AnyDesk (Windows)
  Vulnerable versions: 9.0.4

Timeline of AnyDesk Send Support Information DoS

• 2025-03-30 A closely related AnyDesk Screen Recording link-following flaw (later CVE-2026-15681) is reported to ZDI in the same window, assigned ZDI-CAN-26591.
• 2025-03-30 Giuliano Sanfins (locked-ioc-15, 0x_alibabas) reports the AnyDesk Send Support Information link-following flaw to Trend Micro Zero Day Initiative, assigned ZDI-CAN-26645.
• 2026-06-26 ZDI sends a 0-day publication notice to AnyDesk after the vendor's support team determines the report is out of scope for a fix.
• 2026-07-08 ZDI publicly releases advisory ZDI-26-401 for the Send Support Information link-following DoS vulnerability.
• 2026-07-13 DailyCVE publishes its own technical writeup of CVE-2026-15682, including affected version 9.0.4 and a projected patch date.
• 2026-07-13 Sibling CVE-2026-15681 (AnyDesk Screen Recording link-following DoS, same root cause and affected version 9.0.4) is published via DailyCVE.
• 2026-07-13 CVE-2026-15682 is published on NVD (last modified 2026-07-14); ZDI-26-401 advisory is updated the same day.
• 2026-07-16 Cyber Security News covers the disclosure as an "AnyDesk 0-day vulnerability," driving the RSS hunt that produced this threat record.
• 2026-07-27 Projected (third-party, unconfirmed by vendor) patch date for sibling flaw CVE-2026-15681.
• 2026-08-03 Projected (third-party, unconfirmed by vendor) patch date for CVE-2026-15682; no official AnyDesk patch has been confirmed as of this record.

Sources cited for AnyDesk Send Support Information DoS

• ZDI-26-401: AnyDesk Support Information Link Following Denial-of-Service Vulnerability zerodayinitiative.com · Advisory · 2026-07-13
• AnyDesk Support Information Link Following Denial-of-Service Vulnerability (CVE-2026-15682) dailycve.com · Advisory · 2026-07-13
• CVE-2026-15682 Detail - NVD NVD (NIST) · Advisory · 2026-07-13
• AnyDesk, Screen Recording Link Following Denial-of-Service Vulnerability, CVE-2026-15681 dailycve.com · Advisory · 2026-07-13
• The AnyDesk Breach: Overview and Recommendations akamai.com · Vendor report · 2024-02-06
• AnyDesk 0-Day Vulnerability cybersecuritynews.com · News · 2026-07-16
• Remote access giant AnyDesk resets passwords and revokes certificates after hack techcrunch.com · News · 2024-02-05

Threats related to AnyDesk Send Support Information DoS

• HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege Escalation
• Multiple Zscaler Client Connector Flaws Enable Remote Code Execution (CVE-2026-59568)
• CVE-2026-23918 — Apache HTTP Server mod_http2 Double Free Enabling Unauthenticated DoS and Possible RCE
• Bendix EC80 Truck Brake Controller: 2024 Safety Recall Covertly Patched RCE and DoS Vulnerabilities
• ABB B&R Automation Runtime SDM CVE-2025-3450 — Unauthenticated Network DoS via Improper Resource Locking

Related coverage of this activity

• Agile Engineering August 2026 CSPU
• Tomcat 11.0.25 HTTP/2 auth flaws
• Serv-U deflate DoS
• HollowByte heap fragmentation
• Apache Traffic Server desync

Previous and next in vulnerability

• CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign Previous report
• CVE-2026-14266: 7-Zip Heap-Based Buffer Overflow in XZ Chunk Handling Enables Arbitrary Code Execution Next report