AnyDesk "Send Support Information" Link-Following Denial-of-Service (CVE-2026-15682)

AnyDesk "Send Support Information" Link-Following (TL-2026-1423), also tracked as ZDI-26-401, is a medium-severity software vulnerability scored CVSS 4.7, first published 2026-07-16. It has no confirmed attribution, affects AnyDesk Software GmbH AnyDesk (Windows), references 2 CVEs (CVE-2026-15682, CVE-2026-15681), maps to 15 MITRE ATT&CK techniques (T1036.005, T1059.001, T1082), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1423

Threat ID
TL-2026-1423
Also known as
ZDI-26-401, ZDI-CAN-26645
Severity
MEDIUM
CVSS
4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
it-services, managed-service-providers, government administration, finance, health, technology
Target regions
Global
Detection rules
9
Indicators of compromise
15

A CWE-59 junction/link-following flaw in AnyDesk 9.0.4's "Send Support Information" feature lets a local, already-code-executing low-privileged attacker redirect the feature's file writes via a Windows NTFS junction, causing arbitrary file creation and a denial-of-service crash of the AnyDesk service. Disclosed by ZDI (ZDI-26-401) with no vendor patch yet available and no confirmed active exploitation or public PoC.

How AnyDesk "Send Support Information" Link-Following works

CVE-2026-15682 affects AnyDesk's "Send Support Information" diagnostic-export feature in AnyDesk for Windows version 9.0.4. The feature collects and writes diagnostic data to disk without adequate validation or sanitization of the destination file paths. An attacker who already holds low-privileged local code execution on the target machine can pre-stage a filesystem junction (an NTFS reparse point, e.g. created with `mklink /J` or `fsutil reparsepoint`) pointing from an expected/writable path to a sensitive or critical location such as `C:\Windows\System32\drivers\etc`. When the higher-privileged AnyDesk process invokes the Send Support Information routine, it follows the junction rather than validating that the resolved target is the intended path, and writes attacker-influenced file content to the redirected location. This can overwrite or corrupt files the AnyDesk process would not otherwise be permitted or intended to touch, crashing the AnyDesk service or leaving the endpoint in an unresponsive state — a denial-of-service condition (CVSS Availability impact: High; Confidentiality and Integrity: None).

Exploitation is not remotely reachable: CVSS AV:L and PR:L mean the attacker must already have a local foothold, and the vendor CNA/ZDI scoring of AC:H reflects the timing/race-condition-style setup (creating the junction and inducing AnyDesk to traverse it) needed to reliably trigger the write. NVD's own re-scoring under AC:L (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) suggests some scoring disagreement between NIST and the reporting CNA (ZDI's CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7) on the practical difficulty of triggering the junction race, but both agree the flaw is a local-only DoS with no data exposure.

The vulnerability was reported to ZDI as ZDI-CAN-26645 on 2025-03-30 by Giuliano Sanfins of SiDi (handle 0x_alibabas). ZDI's zero-day disclosure process ran its course over roughly 15 months: a 0-day publication notice was sent to the vendor on 2026-06-26, the advisory was released publicly on 2026-07-08 and updated on 2026-07-13, coinciding with CVE-2026-15682's publication on NVD (2026-07-13, last modified 2026-07-14). ZDI's advisory states AnyDesk's support team determined the report fell outside the scope they intended to fix, so the vulnerability was disclosed without an available patch; third-party reporting (DailyCVE) projects a fix around 2026-08-03, but this is unconfirmed by the vendor.

This disclosure is one of at least two closely related link-following DoS flaws affecting AnyDesk 9.0.4 disclosed by the same researcher in the same window: CVE-2026-15681 affects the Screen Recording file-handling code path (ZDI-CAN-26591) via the same junction-abuse pattern (CWE-59), with an expected patch around 2026-07-27. The recurrence of link-following/reparse-point weaknesses in AnyDesk's file-handling code (a class of flaw AnyDesk has had before, e.g. 2024 wallpaper-handling/reparse-point privilege-escalation reports) is notable for defenders given AnyDesk's footprint as widely-deployed remote-access/remote-support software in IT help desks and MSP environments, and given AnyDesk's unrelated but reputationally significant February 2024 production breach (source code and code-signing certificate theft, forcing a certificate revocation and portal-wide password reset) that already elevated scrutiny of the vendor's software supply chain.

No public proof-of-concept exploit code and no confirmed active exploitation have been reported for CVE-2026-15682 as of this writing. Because exploitation requires an attacker to already have local low-privilege code execution, this flaw functions primarily as a post-compromise DoS/disruption or anti-forensics tool (crashing the very remote-access tool an incident responder might rely on) rather than an initial-access vector.

MITRE ATT&CK techniques used in TL-2026-1423

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.001 PowerShell; T1106 Native API; T1203 Exploitation for Client Execution

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery

defense-impairment

T1222.001 Windows Permissions

Impact

T1485 Data Destruction; T1489 Service Stop; T1499.004 Application or System Exploitation

Resource Development

T1587.001 Malware; T1588.005 Exploits

Reconnaissance

T1592.002 Software; T1595.002 Vulnerability Scanning

Affected products and versions in AnyDesk "Send Support Information" Link-Following

  • AnyDesk Software GmbH — AnyDesk (Windows)
    Vulnerable versions: 9.0.4

Remediation for AnyDesk "Send Support Information" Link-Following

Patches

  • No vendor patch is available for CVE-2026-15682 as of 2026-07-16; AnyDesk's support team reportedly deemed the report out of scope for a fix
  • Sibling flaw CVE-2026-15681 (screen recording feature, same version/root cause) has a projected patch around 2026-07-27

Immediate actions

  • Restrict which local accounts/processes can execute code on endpoints running AnyDesk, since exploitation requires prior low-privilege local code execution
  • Disable or restrict use of the "Send Support Information" feature where it is not operationally required
  • Monitor for anomalous creation of NTFS junctions/reparse points (via mklink /J or fsutil reparsepoint) in user-writable directories on endpoints running AnyDesk
  • Monitor AnyDesk process crash/unresponsiveness events as a potential exploitation indicator, especially on IT help-desk and MSP jump systems

Workarounds

  • Restrict interaction with the AnyDesk client to trusted, already-hardened endpoints until a patch is available (ZDI's stated interim mitigation)
  • Remove or restrict filesystem permissions that allow low-privileged local users to create junctions in directories the AnyDesk support-information feature can write through

Longer-term hardening

  • Apply the vendor patch once released (projected on/after 2026-08-03) for CVE-2026-15682 and the sibling CVE-2026-15681 fix (projected on/after 2026-07-27)
  • Deploy EDR rules that flag reparse-point creation immediately followed by writes from a remote-access-tool process to unexpected system paths
  • Enforce least-privilege on endpoints hosting remote-support tooling to reduce the value of local low-priv code execution as a stepping stone

CVEs associated with AnyDesk "Send Support Information" Link-Following

CVE-2026-15682, CVE-2026-15681

Weaknesses (CWE) in AnyDesk "Send Support Information" Link-Following

CWE-59

Timeline of AnyDesk "Send Support Information" Link-Following

  • A closely related AnyDesk Screen Recording link-following flaw (later CVE-2026-15681) is reported to ZDI in the same window, assigned ZDI-CAN-26591.
  • Giuliano Sanfins (SiDi, 0x_alibabas) reports the AnyDesk Send Support Information link-following flaw to Trend Micro Zero Day Initiative, assigned ZDI-CAN-26645.
  • ZDI sends a 0-day publication notice to AnyDesk after the vendor's support team determines the report is out of scope for a fix.
  • ZDI publicly releases advisory ZDI-26-401 for the Send Support Information link-following DoS vulnerability.
  • DailyCVE publishes its own technical writeup of CVE-2026-15682, including affected version 9.0.4 and a projected patch date.
  • Sibling CVE-2026-15681 (AnyDesk Screen Recording link-following DoS, same root cause and affected version 9.0.4) is published via DailyCVE.
  • CVE-2026-15682 is published on NVD (last modified 2026-07-14); ZDI-26-401 advisory is updated the same day.
  • Cyber Security News covers the disclosure as an "AnyDesk 0-day vulnerability," driving the RSS hunt that produced this threat record.
  • Projected (third-party, unconfirmed by vendor) patch date for sibling flaw CVE-2026-15681.
  • Projected (third-party, unconfirmed by vendor) patch date for CVE-2026-15682; no official AnyDesk patch has been confirmed as of this record.

Sources cited for AnyDesk "Send Support Information" Link-Following

Threats related to AnyDesk "Send Support Information" Link-Following

Detection coverage for TL-2026-1423

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1423 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats