CVE-2026-15681

Executive Summary

CVE-2026-15681 is a locally exploitable, link-following (junction/symlink) vulnerability in AnyDesk's screen recording file handling, which allows low-privileged attackers to create a denial-of-service (DoS) condition on affected systems. The flaw, discovered by Trend Micro's Zero Day Initiative (ZDI) and tracked as ZDI-CAN-26591, carries a CVSS score of 4.7 (Medium) and leverages a CWE-59 weakness (Improper Link Resolution Before File Access) to abuse the AnyDesk service's file-writing privileges. The vulnerability affects all AnyDesk installations where the service runs with elevated privileges and writes screen recording session files to user-writable directories; exploitation requires local code execution at a low privilege level, meaning the attack surface is primarily shared workstations, terminal servers, or environments with untrusted local users.

Technical Analysis

CVE-2026-15681 resides in AnyDesk's handling of screen recording files. The core weakness is a classic link following vulnerability (CWE-59) where the application, running as a privileged service, attempts to create or write to a file path that can be redirected by a local attacker using a Windows junction point or NTFS symbolic link.

Vulnerability Mechanism:

The flaw manifests when AnyDesk records a screen session and writes the output file. The application does not verify whether the target path exists as a legitimate file or if it has been pre-planted as a junction. A low-privileged attacker with access to the user's profile or the temp directory where AnyDesk writes recordings can create a junction that points to an arbitrary filesystem location, such as a critical system directory or a file owned by a higher-integrity process.

Specifically, the vulnerable code path follows these steps:

1. The AnyDesk service initiates a screen recording session.
2. The service constructs a file path for the output .anydesk or .mp4 recording.
3. Before writing, the service resolves the path. If an attacker has created a junction at that location pointing to a target folder (e.g., C:\Windows\System32 or C:\Windows\System32\config), the service will dereference the junction and write data to the target.
4. By pointing the junction to a non-existent directory, a read-only folder, or a file required by critical services, the attacker causes the AnyDesk service to fail, crash, or corrupt system state — resulting in a denial of service.

Attack Surface:

The attack is purely local. An attacker needs:

• Code execution at a low-integrity level (e.g., a standard domain user).
• Write access to a folder AnyDesk uses for temporary files or recordings (commonly %TEMP%, %USERPROFILE%\Documents, or the AnyDesk installation directory's writable subfolders).
• Knowledge of the exact file path AnyDesk will use for the next recording session.

Code-Level Explanation:

The vulnerability is a typical TOCTOU (Time-of-Check to Time-of-Use) race in the service's file-handling routine. The service checks for the existence of a path, but between the check and the CreateFileW/MoveFileEx call, an attacker can swap in a junction. The absence of FILE_OPEN_REPARSE_POINT flags in the CreateFile call or the lack of a GetFileInformationByHandle check for reparse tags permits the redirect.

CVSS Breakdown:

• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Impact: Availability High (A:H), Confidentiality None (C:N), Integrity None (I:N)

Exploitation Scenarios

The following attack chain describes how an attacker leverages CVE-2026-15681 to achieve a denial-of-service condition:

1. Reconnaissance / Target Identification: The attacker identifies a target machine running AnyDesk (version unpatched). Reconnaissance is performed via local enumeration (tasklist, sc query, or checking for AnyDesk.exe process). The attacker locates the AnyDesk recording directory — typically %APPDATA%\AnyDesk\ or the user's Documents folder — by inspecting running processes' command lines or the AnyDesk configuration files (e.g., service.conf, system.conf).

2. Switch (Weaponization) — Creating the Junction:

   • The attacker opens an elevated command prompt? No — the attacker uses low-privilege tools like cmd /c with mklink /J or PowerShell's New-Item -ItemType Junction.
   • The attacker determines the exact filename AnyDesk will use for the next recording. AnyDesk typically generates filenames using a timestamp pattern like Recording_YYYY-MM-DD_HH-MM-SS.mp4.
   • The attacker pre-plants a junction at the Recording path:

     mklink /J "C:\Users\victim\Videos\AnyDesk\Recording_2026-07-01_12-00-00.mp4" "C:\Windows\System32\config"
     

     (Note: The exact directory varies; the attacker can also create the junction in %TEMP% if AnyDesk uses that for staging.)

3. Trigger / Execution:

   • The attacker waits for or compels the AnyDesk service to start a screen recording session (e.g., triggering a remote support session via the AnyDesk API, or via the service's scheduled/routine screen capture).
   • When the recording starts, AnyDesk attempts to write the screen capture stream to the junction path.
   • Instead of writing to the intended user-accessible location, the service's write operation is redirected to C:\Windows\System32\config (or another critical folder).

4. Post-Exploitation Impact — Denial of Service:

   • Option A (File Corruption): The write operation to C:\Windows\System32\config causes the AnyDesk service to receive an ACCESS_DENIED or STATUS_OBJECT_NAME_COLLISION error. The service's error-handling routine is not robust, causing the AnyDesk process to crash — terminating all active remote sessions and rendering the machine's remote support capability unavailable.
   • Option B (Filesystem DoS): The attacker points the junction to a non-existent directory path (e.g., C:\Windows\System32\drivers\etc\hosts as a directory). The service repeatedly retries the write operation, consuming CPU and disk I/O, starving critical system processes and eventually causing a system-wide hang.
   • Option C (Conditional System Corruption): If AnyDesk has permissions to write to the target directory (e.g., when running as SYSTEM), the attacker can direct the recording data into C:\Windows\System32\config\SAM or C:\Windows\System32\config\SYSTEM (if the junction can bypass ACLs via the service's privileges), corrupting the registry hive and causing a Blue Screen of Death (BSOD) on the next reboot.

Parenthetical Note: The attack requires local access and the ability to execute arbitrary commands at low privilege; it is not remotely exploitable without pre-existing local code execution.

Impact Assessment

Business Impact:

• Availability Breach (Primary): The vulnerability directly enables a denial-of-service condition against the AnyDesk service — and in the worst-case scenario, against the underlying operating system. For organizations that rely on AnyDesk for remote support (IT helpdesk, managed service providers), a successful exploit translates to immediate loss of remote access capabilities. If the attacker targets the registry hive, the entire endpoint may be rendered inoperable, requiring OS reinstallation.
• Integrity Impact: None directly (integrity subscores are 0), but the side effect of arbitrary file writes via junction abuse allows an attacker to corrupt arbitrary files that the AnyDesk service has write access to (typically user-writable directories). This can be leveraged to overwrite application configs or user files.
• Confidentiality Impact: None. The flaw does not allow data exfiltration or reading of sensitive files.

Affected Systems:

• AnyDesk versions up to 8.x (all builds prior to pending patch).
• Windows platforms (client and server editions) where AnyDesk runs as a service and enables screen recording.
• Multi-user environments (terminal servers, RDS farms, shared workstations) are at higher risk due to the presence of low-privileged local users.

Blast Radius:

• CVSS Base Score: 4.7 (Medium). The low CVSS reflects the requirement for local code execution. However, EPSS probability of exploitation is 0.00104 (approximately 1.2% percentile), indicating limited current weaponization in the wild. The CISA KEV catalog does not include this CVE, and no public PoC or Nuclei template exists.
• Chained Attacks: A determined attacker can chain this DoS with social engineering (convincing a user to run a benign-looking shortcut that creates the junction) to facilitate remote service disruption without direct shell access.

Blast Radius Severity: Medium — The DoS vector is limited to the local system, but the ability to crash the AnyDesk service can cascade into a denial of remote management for an entire fleet if a centralized AnyDesk management console depends on the compromised agent.

Detection Guidance

Sigma Rule

title: AnyDesk Junction Creation for Screen Recording Redirection
id: 5f65c3de-6c5a-4c6e-9a0a-6b1f315a4b42
status: experimental
description: Detects creation of Windows junctions or symbolic links pointing to system directories shortly before AnyDesk recording initiation.
logsource:
  category: process_creation
  product: windows
detection:
  selection_junction:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'mklink'
      - 'New-Item -ItemType Junction'
  selection_target:
    CommandLine|contains:
      - 'System32'
      - 'config'
      - 'Users\'
  selection_anydesk_related:
    CommandLine|contains:
      - 'AnyDesk'
      - 'Recording'
      - '.mp4'
      - '.anydesk'
  condition: selection_junction and selection_target and selection_anydesk_related
level: medium
falsepositives:
  - Legitimate IT admins creating junctions for application installers
tags:
  - attack.t1499
  - cve.2026-15681

YARA Rule

rule AnyDesk_Junction_Abuse_CVE_2026_15681 {
    meta:
        author = "ValtersIT Threat Intel"
        date = "2026-07-01"
        description = "Detects junction creation commands targeting AnyDesk recording paths"
        cve = "CVE-2026-15681"
        score = 60
    strings:
        $s1 = "mklink /J" ascii wide
        $s2 = "New-Item -ItemType Junction" ascii wide
        $s3 = "AnyDesk" ascii wide
        $s4 = ".mp4" ascii wide
        $s5 = "Recording" ascii wide
        $s6 = "System32\\config" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D) and
        (2 of ($s1, $s2)) and
        (1 of ($s3, $s5)) and
        ($s6 or $s4)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"AnyDesk CVE-2026-15681 Potential Junction Exploit Command Over HTTP Tunneling"; flow:to_server,established; content:"AnyDesk"; nocase; content:"Recording"; nocase; content:"junction"; distance:0; nocase; sid:20261568101; rev:1; metadata:cve CVE-2026-15681;)

Note: Given the purely local nature of this attack, network detection is limited. The rule above is a placeholder for any HTTP-based remote management traffic that includes indicators of junction command strings (rare). Priority should be placed on host-based detection.

Elastic Detection

process where process.executable in ("C:\\Windows\\System32\\cmd.exe", "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", "C:\\Program Files\\PowerShell\\7\\pwsh.exe") and (
  (process.command_line contains "mklink" and process.command_line contains "/J") or
  (process.command_line contains "New-Item" and process.command_line contains "Junction")
) and (
  process.command_line contains "AnyDesk" or
  process.command_line contains "Recording" or
  process.command_line contains ".mp4"
) and process.command_line contains "System32"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| where EventCode=4688
| search (CommandLine="*mklink*" OR CommandLine="*New-Item*ItemType Junction*")
| search (CommandLine="*AnyDesk*" OR CommandLine="*Recording*" OR CommandLine="*.mp4*")
| search CommandLine="*System32*"
| table _time, host, user, New_Process_Name, CommandLine, Parent_CommandLine
| stats count by host, user

Wazuh OSSEC Rule

<group name="anydesk_cve_2026_15681">
  <rule id="265911" level="10">
    <if_sid>5710</if_sid>
    <match>mklink|New-Item -ItemType Junction</match>
    <regex>AnyDesk|Recording|\.mp4</regex>
    <description>Possible junction abuse targeting AnyDesk (CVE-2026-15681)</description>
    <group>anydesk,cve-2026-15681,attack.t1499,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED) — No patch evidence exists from any tracked source (CVE feed, vendor advisories, OSV packages). The vendor has not released a public fix or workaround as of this report date. The absence of a vendor response, combined with the CVE's 0-day status, means effective mitigation relies entirely on compensating controls.

Immediate Mitigations (until patch):

1. Disable Screen Recording: Restrict or disable the AnyDesk screen recording feature via Group Policy or the AnyDesk configuration (anydesk.conf). Set ad.anynet.recording.enabled = 0 to prevent the service from creating recording files.
2. Restrict File Write Paths: Use Windows AppLocker or WDAC to block standard users from executing cmd.exe, powershell.exe, or wmic.exe with junction-creation arguments (mklink).
3. Apply Folder ACLs: Ensure the directory where AnyDesk writes recordings (e.g., %USERPROFILE%\Videos\AnyDesk, %TEMP%) is not writable by standard users beyond their own profile. Use explicit Deny ACEs for BUILTIN\Users on the AnyDesk recording root folder.
4. Run AnyDesk as Limited Service: Reconfigure the AnyDesk service to run under a standard (non-SYSTEM) account if the environment permits, reducing the privilege level available to a junction redirect.
5. Monitor with the detection rules above for junction creation attempts.

Patch/Upgrade Steps:

• Monitor the AnyDesk security advisory page (https://security.anydesk.com) and the ZDI advisory (https://www.zerodayinitiative.com/advisories/) for ZDI-CAN-26591.
• When a patched build is released, upgrade ALL endpoints to the latest AnyDesk version. In multi-user deployments, test the patch in staging before broad rollout.

Long-Term Hardening:

1. Adopt the principle of least privilege: Remove local admin rights from standard users; require UAC elevation for any junction creation.
2. Enable Windows Defender Exploit Guard / Attack Surface Reduction (ASR) rules that block mklink execution and suspicious file writes.
3. Harden the filesystem: Enable NTFS auditing on critical system directories (.config, .SAM) and aggregate events into the SIEM.
4. Review AnyDesk version cadence: Subscribe to the vendor's security mailing list to receive notifications for future CVEs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15681 — Official NVD page containing vulnerability description and CVSS vector.
2. ZDI Advisory (ZDI-CAN-26591): https://www.zerodayinitiative.com/advisories/upcoming/ — List of upcoming ZDI advisories; the CVE reference is pending publication.
3. AnyDesk Security Page: https://security.anydesk.com — Vendor security advisories and download links for patched versions (check periodically for updates).
4. MITRE ATT&CK T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/ — MITRE technique mapping for this vulnerability's impact chain.
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirms CVE-2026-15681 is not listed as of this report (no known exploits in the wild; EPSS demonstrates low active exploitation probability).

Threat Actor Campaigns: No known active exploitation campaigns exist as of this report. The EPSS percentile (1.2%) and absence from CISA KEV indicate that weaponized exploits are not presently circulating publicly. Attackers following an opportunistic model may still use this in conjunction with other local priv-esc chain attacks in environments where the junction creation does not trigger existing security controls.