CVE-2026-15682

Executive Summary

CVE-2026-15682 is a locally exploitable denial-of-service (DoS) vulnerability in AnyDesk's "Send Support Information" feature, discovered by the Zero Day Initiative (ZDI-CAN-26645). The flaw allows a low-privileged local attacker to abuse a link-following weakness (CWE-59) to create arbitrary files on the system via junction manipulation, leading to a denial-of-service condition. The vulnerability carries a CVSS score of 4.7 (Medium severity), has no known patch available, and is not listed on CISA's Known Exploited Vulnerabilities catalog. AnyDesk installations are at risk; exploitation requires prior low-privilege code execution on the target, making this most relevant in multi-user environments and endpoint contexts where untrusted local users exist.

Technical Analysis

CVE-2026-15682 is classified as an improper link resolution before file access vulnerability (CWE-59). The core flaw resides in AnyDesk's "Send Support Information" feature, a diagnostic utility that packages system and application state into an archive for transmission to support personnel. The feature, when invoked, creates a temporary output file. However, the path resolution logic does not validate whether the target path components are symbolic links (symlinks) or NTFS junctions.

Vulnerability Mechanism:

1. Junction Creation: An attacker with low-privileged access on the target system can create an NTFS junction (or symbolic link) pointing from a predictable temporary directory path — or a path component used by the support information generator — to an arbitrary location on the filesystem, including system-critical directories such as C:\Windows\System32, driver directories, or the root of the boot volume.

2. Link Following: When the "Send Support Information" feature executes (either by a user manually or via an automated support session), AnyDesk's service component attempts to write the diagnostic archive to the resolved path. Because the application fails to check whether intermediate directories are reparse points (junctions/symlinks), the file write operation follows the link and writes to the attacker-specified destination.

3. Arbitrary File Write: By crafting the junction to point to a location where a file with a predictable name (e.g., support_info.zip or similar) would be disruptive, the attacker can cause the service to overwrite or create files in protected or critical locations. Examples include:

   • Overwriting an existing configuration file (corrupting service behavior).
   • Filling a filesystem by repeatedly triggering the write to a small volume.
   • Placing files in System32 that conflict with legitimate system operations.

4. Denial of Service: The resultant file placement or filesystem exhaustion causes system instability, service failure, or a full crash of the AnyDesk service, potentially requiring manual intervention to restore. In severe cases, if the attacker targets boot-critical files, the system may fail to start.

Attack Surface: This is a local attack vector. The attacker needs prior code execution at low integrity (e.g., via a dropper, an existing foothold, or a shared workstation scenario). The AnyDesk service typically runs with elevated privileges, so the arbitrary file write is performed with SYSTEM-level rights, amplifying the impact.

CWE Classification: CWE-59 — Improper Link Resolution Before File Access ('Link Following'). This class of bug is well-documented in Windows applications that fail to use the FILE_FLAG_OPEN_REPARSE_POINT flag or fail to canonicalize paths before writing.

Exploitation Scenarios

Scenario: Privilege Escalation to System DoS in an Enterprise Environment

1. Reconnaissance/Target Identification: The attacker identifies a target host running AnyDesk (common in remote-work environments). They already have low-privileged code execution via a phishing dropper or a compromised user account. They enumerate the AnyDesk installation directory and identify the predictable temp file path used by the support information feature (often under %TEMP% or C:\ProgramData\AnyDesk).

2. Weaponization — Junction Creation: Using a command shell or a small PowerShell script, the attacker creates an NTFS junction:

   cmd /c mklink /J "C:\ProgramData\AnyDesk\tmp\support" "C:\Windows\System32\drivers\etc"
   

   Alternatively, they target a specific file:

   cmd /c mklink /J "C:\Users\victim\AppData\Local\Temp\support" "C:\Windows\System32"
   

   The junction maps the directory that AnyDesk will use for its temporary output to a critical system directory.

3. Payload/Trigger Execution: The attacker then triggers the "Send Support Information" feature. This can be done by:

   • Remotely initiating a support session (if the attacker can access the AnyDesk UI).
   • Dropping a scheduled task that calls the AnyDesk CLI with the support-information flag.
   • Social engineering the victim into clicking "Send Support Info" in the AnyDesk client.

   When the feature runs, the service attempts to write support_package.zip (or equivalent) into the junctioned directory. The OS resolves the junction, and the file is written into System32 or another protected path.

4. Post-Exploitation Impact: The attacker can:

   • Overwrite an existing critical file (e.g., a system driver configuration) causing a blue-screen-of-death (BSOD) on next boot.
   • Fill the system drive with junk data by repeatedly triggering the feature, causing disk-full conditions that halt all services.
   • Place a file named identically to a scheduled system task's input, causing that task to fail repeatedly, leading to cascading service failures.

Variation — Persistence: If the attacker targets a path that is read at system startup (e.g., placing a .dll file with a specific name in a System32 subfolder where DLL search order includes it), they could achieve persistence or further privilege escalation, although the primary stated impact is DoS.

Impact Assessment

CVSS Subscore Analysis: The CVSS score of 4.7 reflects Medium severity. The vector (while not fully specified) implies a local attack (AV:L), low attack complexity (AC:L), and no privileges required beyond low-level code execution (PR:L). The primary impact is on availability (C:N/I:L/A:H or similar), given that the arbitrary file write is the vector for causing a denial-of-service.

Business Impact:

• Availability: The most direct impact is a denial-of-service on the AnyDesk service and potentially the entire host. For enterprises relying on AnyDesk for remote support, this can halt helpdesk operations, break remote access, and stall incident response.
• Integrity: Low direct impact, but the arbitrary file write could corrupt configuration data if the attacker is creative.
• Confidentiality: Not the primary target; however, a compromised system may be leveraged further.

Affected Systems: Any AnyDesk installation (client and service) on Windows platforms. The vulnerability is relevant to all environments where low-privileged users share a host, such as:

• VDI / Citrix environments hosting multiple user sessions.
• Shared lab machines or kiosks.
• Endpoints where a user's account has been partially compromised.

Blast Radius: The attack requires local access; thus, the blast radius is per-host. However, in a VDI environment, one compromised session could disrupt the entire pool if the filesystem is shared. Lateral movement is not directly enabled but may be facilitated if the DoS forces a reboot that drops security controls.

Detection Guidance

Sigma Rule

title: AnyDesk Junction Creation for Support Info Exploitation
id: 8f4b2c9e-5a71-4d83-9e3f-2b1c6a7d8e90
status: experimental
description: Detects creation of NTFS junctions that point from AnyDesk temp paths to system directories, indicative of CVE-2026-15682 exploitation.
author: ValtersIT Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - 'mklink'
            - 'New-Item -ItemType Junction'
    selection_anydesk_path:
        CommandLine|contains|all:
            - 'AnyDesk'
            - 'support'
    selection_system_target:
        CommandLine|contains:
            - 'System32'
            - 'Windows'
            - '\drivers\etc'
    condition: selection_tool and selection_anydesk_path and selection_system_target
falsepositives:
    - Legitimate admin actions creating junctions for maintenance
level: high
tags:
    - attack.t1491.001
    - cve.2026.15682

YARA Rule

rule AnyDesk_CVE_2026_15682_Junction_Abuse
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects AnyDesk installation files or scripts that contain junction creation targeting system paths, related to CVE-2026-15682"
        cve = "CVE-2026-15682"
        date = "2026-01-01"
    strings:
        $s1 = "mklink /J" ascii nocase
        $s2 = "New-Item -ItemType Junction" ascii nocase
        $s3 = "AnyDesk" ascii nocase
        $s4 = "System32" ascii nocase
        $s5 = "C:\\Windows" ascii nocase
        $s6 = "support" ascii nocase
        $s7 = "temp" ascii nocase
    condition:
        (uint16(0) == 0x5A4D) and  // PE file check
        ( all of ($s1, $s3, $s4) or all of ($s2, $s3, $s5) or 2 of ($s3, $s6, $s7) and 1 of ($s1, $s2) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"AnyDesk CVE-2026-15682 Support Info Junction Exploit - Downloading Malicious Script"; flow:established,to_server; content:"POST"; http_method; content:"/download"; http_uri; content:"mklink"; nocase; content:"/J"; distance:0; content:"AnyDesk"; distance:1; content:"System32"; distance:1; classtype:attempted-dos; sid:2026156821; rev:1;)

# Note: This vulnerability is local. Network detection is limited to C2 or dropper delivery.
# Alternative rule for detecting triggered file write attempts (if any network-based AnyDesk remote session is abused):
alert tcp any any -> any any (msg:"AnyDesk CVE-2026-15682 - Suspicious Remote Session Command Sequence"; flow:established,to_server; content:"|01 02 03|"; depth:3; content:"support"; nocase; within:100; content:"system32"; nocase; within:200; classtype:attempted-dos; sid:2026156822; rev:1;)

Elastic Detection

// EQL to detect junction creation targeting AnyDesk paths
process where event.action == "start" and
  process.name in ("cmd.exe", "powershell.exe") and
  (
    process.command_line : "*mklink*" and process.command_line : "*AnyDesk*" and
    process.command_line : ("*System32*", "*Windows*", "*drivers*")
  ) or
  (
    process.command_line : "*New-Item*Junction*" and process.command_line : "*AnyDesk*"
  )

// EQL to detect AnyDesk service writing files to non-standard paths (post-exploitation indicator)
file where process.name : "AnyDesk.exe" and
  file.path : ("C:\\Windows\\System32\\*", "C:\\Windows\\*") and
  not file.path : "C:\\Windows\\Temp\\*"

Splunk SPL Query

index=endpoint sourcetype=WinEventLog:Security EventCode=4688
| search (CommandLine="*mklink*" OR CommandLine="*New-Item*Junction*") AND CommandLine="*AnyDesk*" AND (CommandLine="*System32*" OR CommandLine="*Windows*")
| stats count by host, user, CommandLine, dest
| where count > 1
| table _time, host, user, CommandLine, dest, count

Additional SPL for file activity:

index=filesystem sourcetype=filesystem_monitor
| where file_path LIKE "C:\\Windows\\System32\\%" AND process_name="AnyDesk.exe"
| stats count by file_path, action, host
| table _time, host, file_path, action, count

Wazuh OSSEC Rule

<group name="anydesk,cve-2026-15682,">
    <rule id="100521" level="12">
        <if_sid>530</if_sid>
        <match>mklink /J|New-Item -ItemType Junction</match>
        <regex>AnyDesk</regex>
        <regex>System32|Windows|drivers</regex>
        <description>AnyDesk CVE-2026-15682: Junction creation targeting system directories detected</description>
        <group>attempted-dos,</group>
        <mitre>
            <id>T1491.001</id>
        </mitre>
    </rule>

    <rule id="100522" level="10">
        <if_sid>100521</if_sid>
        <match>success</match>
        <description>AnyDesk CVE-2026-15682: Successful junction creation - immediate investigation required</description>
        <group>dos,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — No patch evidence exists from any tracked source. The vendor has not released a fix as of the writing of this report.

Immediate Mitigations (1):

• Block the creation of junctions/symlinks by non-administrative users. This can be achieved via Group Policy: Security Settings → Local Policies → User Rights Assignment → Create symbolic links — remove all non-admin users/groups.
• Apply a filesystem ACL on the AnyDesk temporary support information directory (e.g., C:\ProgramData\AnyDesk\temp) to deny FILE_CREATE and FILE_WRITE permissions to non-SYSTEM and non-Admin users. This prevents a low-privileged attacker from creating a junction inside or replacing the temp path.
• Use Windows Defender Attack Surface Reduction (ASR) rules to block mklink execution from unauthorized processes. Rule GUID: 3b576869-a4ec-4529-8536-b80a7765e899 (Block process creations originating from PSExec and WMI) may help; additionally, custom ASR rules can block cmd.exe and powershell.exe from creating junctions.

Patch/Upgrade Steps (2): While no patch is available, apply the following:

• Place a monitoring policy on the vendor's release channels (AnyDesk official website, security advisories). Subscribe to ZDI advisories for CVE-2026-15682 to be alerted the moment a fix is published.
• Upgrade to the latest AnyDesk version as soon as the vendor releases a patched build (even if the specific fix is not announced, regularly updating reduces exposure to other known flaws).
• If any unofficial or beta versions mention a "link following" fix, test and deploy them in a staging environment first.

Long-Term Hardening (3):

• Implement the principle of least privilege. Ensure standard users cannot create junctions or symbolic links. On Windows 10/11, standard users cannot create symlinks by default, but they CAN create NTFS junctions, so explicitly gpo-block junction creation if possible.
• Deploy Endpoint Detection and Response (EDR) tools with behavioral analytics to flag processes that create junctions pointing to system directories, especially when originating from a temp path.
• Enforce application whitelisting (e.g., AppLocker) to prevent unknown executables from running, reducing the likelihood of an attacker establishing the initial low-privilege foothold required to exploit this flaw.
• For VDI environments, use non-persistent, stateless pools to minimize the impact of a single compromised session.

References

1. ZDI Advisory (Primary): ZDI-CAN-26645 — AnyDesk Support Information Link Following DoS Vulnerability — The originating disclosure from the Zero Day Initiative, containing technical details.
2. NVD Entry: CVE-2026-15682 — NVD — Official NVD record with CVSS metrics and description.
3. AnyDesk Security Advisory (Pending): https://anydesk.com/en/security — The vendor's security advisory page. Monitor for an update referencing CVE-2026-15682 or the "Send Support Information" feature fix.
4. CWE-59 Reference: CWE-59: Improper Link Resolution Before File Access — The weakness category documentation.
5. CISA Known Exploited Vulnerabilities Catalog: CISA KEV — Entry not present as of report date (NO). Monitor for changes.

Known Threat Actor Campaigns: No evidence of active in-the-wild exploitation has been reported at the time of writing. The EPSS score of 0.00131 (3.1% percentile) indicates a very low exploit probability, likely due to the requirement for local access and the Medium severity. However, the lack of a patch makes this a potential candidate for weaponization in targeted attacks against AnyDesk-centric infrastructures, particularly if an attacker already holds a low-privilege foothold. SOC teams should nonetheless incorporate the detection rules above into standard hunting workflows to establish a baseline.