# AnyDesk "Send Support Information" Link-Following Denial-of-Service (CVE-2026-15682)

> A CWE-59 junction/link-following flaw in AnyDesk 9.0.4's "Send Support Information" feature lets a local, already-code-executing low-privileged attacker redirect the feature's file writes via a Windows NTFS junction, causing arbitrary file creation and a denial-of-service crash of the AnyDesk service. Disclosed by ZDI (ZDI-26-401) with no vendor patch yet available and no confirmed active exploitation or public PoC.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1423
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-anydesk-send-support-information-dos-tl-2026-1423.webp?v=8963a86b (Threadlinqs threat intel: CVE-2026-15682 AnyDesk Junction DoS: Detection & IOCs (TL-2026-1423) — Medium severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-1423
- **Severity:** MEDIUM (CVSS 4.7)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15
- **CVEs:** CVE-2026-15682, CVE-2026-15681

## Description

CVE-2026-15682 affects AnyDesk's "Send Support Information" diagnostic-export feature in AnyDesk for Windows version 9.0.4. The feature collects and writes diagnostic data to disk without adequate validation or sanitization of the destination file paths. An attacker who already holds low-privileged local code execution on the target machine can pre-stage a filesystem junction (an NTFS reparse point, e.g. created with `mklink /J` or `fsutil reparsepoint`) pointing from an expected/writable path to a sensitive or critical location such as `C:\Windows\System32\drivers\etc`. When the higher-privileged AnyDesk process invokes the Send Support Information routine, it follows the junction rather than validating that the resolved target is the intended path, and writes attacker-influenced file content to the redirected location. This can overwrite or corrupt files the AnyDesk process would not otherwise be permitted or intended to touch, crashing the AnyDesk service or leaving the endpoint in an unresponsive state — a denial-of-service condition (CVSS Availability impact: High; Confidentiality and Integrity: None).

Exploitation is not remotely reachable: CVSS AV:L and PR:L mean the attacker must already have a local foothold, and the vendor CNA/ZDI scoring of AC:H reflects the timing/race-condition-style setup (creating the junction and inducing AnyDesk to traverse it) needed to reliably trigger the write. NVD's own re-scoring under AC:L (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) suggests some scoring disagreement between NIST and the reporting CNA (ZDI's CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7) on the practical difficulty of triggering the junction race, but both agree the flaw is a local-only DoS with no data exposure.

The vulnerability was reported to ZDI as ZDI-CAN-26645 on 2025-03-30 by Giuliano Sanfins of SiDi (handle 0x_alibabas). ZDI's zero-day disclosure process ran its course over roughly 15 months: a 0-day publication notice was sent to the vendor on 2026-06-26, the advisory was released publicly on 2026-07-08 and updated on 2026-07-13, coinciding with CVE-2026-15682's publication on NVD (2026-07-13, last modified 2026-07-14). ZDI's advisory states AnyDesk's support team determined the report fell outside the scope they intended to fix, so the vulnerability was disclosed without an available patch; third-party reporting (DailyCVE) projects a fix around 2026-08-03, but this is unconfirmed by the vendor.

This disclosure is one of at least two closely related link-following DoS flaws affecting AnyDesk 9.0.4 disclosed by the same researcher in the same window: CVE-2026-15681 affects the Screen Recording file-handling code path (ZDI-CAN-26591) via the same junction-abuse pattern (CWE-59), with an expected patch around 2026-07-27. The recurrence of link-following/reparse-point weaknesses in AnyDesk's file-handling code (a class of flaw AnyDesk has had before, e.g. 2024 wallpaper-handling/reparse-point privilege-escalation reports) is notable for defenders given AnyDesk's footprint as widely-deployed remote-access/remote-support software in IT help desks and MSP environments, and given AnyDesk's unrelated but reputationally significant February 2024 production breach (source code and code-signing certificate theft, forcing a certificate revocation and portal-wide password reset) that already elevated scrutiny of the vendor's software supply chain.

No public proof-of-concept exploit code and no confirmed active exploitation have been reported for CVE-2026-15682 as of this writing. Because exploitation requires an attacker to already have local low-privilege code execution, this flaw functions primarily as a post-compromise DoS/disruption or anti-forensics tool (crashing the very remote-access tool an incident responder might rely on) rather than an initial-access vector.

## MITRE ATT&CK

- T1592.002 Software
- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1587.001 Malware
- T1203 Exploitation for Client Execution
- T1059.001 PowerShell
- T1106 Native API
- T1222.001 Windows Permissions
- T1036.005 Match Legitimate Resource Name or Location
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1499.004 Application or System Exploitation
- T1489 Service Stop
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AnyDesk Diagnostic/Recording Write Immediately Following Reparse-Point Creation (Redirect Confirmation)** (`TL-2026-1423-SPL-002`)

Correlates a junction/reparse-point creation event with a subsequent AnyDesk.exe file-write to the same path within a short window — the core CWE-59 link-following redirect that turns a benign diagnostic export or screen recording into an out-of-bounds write against CVE-2026-15682/CVE-2026-15681.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1222.001, T1499.004
- **Data sources:** sysmon, windows_filesystem_auditing
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11)
| eval etype=if(EventCode=1,"process","filewrite")
| eval is_junction=if(etype="process" AND (match(CommandLine,"(?i)mklink.*\/J") OR match(CommandLine,"(?i)reparsepoint")),1,0)
| eval is_anydesk_write=if(etype="filewrite" AND match(Image,"(?i)anydesk\.exe"),1,0)
| stats earliest(eval(if(is_junction=1,_time,null()))) as junction_time latest(eval(if(is_anydesk_write=1,_time,null()))) as write_time values(TargetFilename) as target_paths by host
| where isnotnull(junction_time) AND isnotnull(write_time) AND (write_time - junction_time) >= 0 AND (write_time - junction_time) <= 300
| table host, junction_time, write_time, target_paths
```

### Microsoft KQL

```kql
let junctions = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("mklink", "reparsepoint") and ProcessCommandLine has "/J"
| project DeviceName, JunctionTime = Timestamp, JunctionCmd = ProcessCommandLine;
let anydeskWrites = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "AnyDesk.exe"
| project DeviceName, WriteTime = Timestamp, FileName, FolderPath;
junctions
| join kind=inner (anydeskWrites) on DeviceName
| where WriteTime between (JunctionTime .. JunctionTime + 5m)
| project DeviceName, JunctionTime, JunctionCmd, WriteTime, FileName, FolderPath
```

### Sigma

```yaml
title: AnyDesk File Write Shortly After Reparse Point Creation (Link-Following Redirect)
id: 8f1c6a2e-1423-4c00-9a11-anydesk-cwe59
status: experimental
description: Detects an AnyDesk.exe file write occurring within 5 minutes of a junction/reparse point creation, consistent with successful CWE-59 link-following exploitation of CVE-2026-15682/CVE-2026-15681.
references:
    - https://www.zerodayinitiative.com/advisories/ZDI-26-401/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15682
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-16
tags:
    - attack.defense-evasion
    - attack.t1222.001
    - attack.impact
    - attack.t1499.004
    - cve.2026.15682
    - cve.2026.15681
logsource:
    category: process_creation
    product: windows
detection:
    selection_junction:
        Image|endswith:
            - '\cmd.exe'
            - '\fsutil.exe'
        CommandLine|contains:
            - 'mklink /J'
            - 'reparsepoint'
    selection_writer:
        Image|endswith: '\AnyDesk.exe'
    timeframe: 5m
    condition: selection_junction and selection_writer
falsepositives:
    - Legitimate deduplication/backup tooling that also uses junctions
level: high
```

**Known false positives:**

- Coincidental unrelated junction creation and AnyDesk activity within the same 5-minute window on busy IT help-desk endpoints

**Tuning notes:** Narrow the correlation window from 5 minutes if false positives are high on shared jump boxes; add file-hash/target-path allowlisting for known-legitimate AnyDesk export directories.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Repeated Reparse-Point Probing Across Candidate Output Directories (Junction Race Staging) (locked: unlock with TL Creds)
- Remote-Support Process Write to System-Adjacent Path via Reparse Point (locked: unlock with TL Creds)
- Vulnerability/Software Reconnaissance Targeting AnyDesk 9.0.4 Prior to Local Exploitation (locked: unlock with TL Creds)
- AnyDesk Send Support Information Invocation Immediately Preceded by Junction Creation (locked: unlock with TL Creds)
- AnyDesk Screen Recording Feature Write Redirected via Reparse Point (Sibling CVE-2026-15681) (locked: unlock with TL Creds)
- Reparse-Point-Enabled Data Destruction Pattern Following Remote-Support Process Write (locked: unlock with TL Creds)
- NTFS Junction/Reparse-Point Creation via mklink or fsutil (Exploitation Staging) (locked: unlock with TL Creds)
- AnyDesk Service Crash or Unresponsiveness Following Support/Recording Feature Invocation (Impact Confirmation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [ZDI-26-401: AnyDesk Support Information Link Following Denial-of-Service Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-26-401/)
- [AnyDesk Support Information Link Following Denial-of-Service Vulnerability (CVE-2026-15682)](https://dailycve.com/anydesk-support-information-link-following-denial-of-service-vulnerability-cve-2026-15682-medium-dc-jul2026-971/)
- [AnyDesk 0-Day Vulnerability](https://cybersecuritynews.com/anydesk-0-day-vulnerability/)
- [CVE-2026-15682 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-15682)
- [AnyDesk, Screen Recording Link Following Denial-of-Service Vulnerability, CVE-2026-15681](https://dailycve.com/anydesk-screen-recording-link-following-denial-of-service-vulnerability-cve-2026-15681-medium-dc-jul2026-979/)
- [Remote access giant AnyDesk resets passwords and revokes certificates after hack](https://techcrunch.com/2024/02/05/remote-access-giant-anydesk-resets-passwords-and-revokes-certificates-after-hack/)
- [The AnyDesk Breach: Overview and Recommendations](https://www.akamai.com/blog/security-research/anydesk-breach-what-to-know-mitigations-and-recommendations)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1423