New Zero-Day Flaw in AnyDesk Exploits Support Feature to Trigger DoS Attacks
A recently disclosed zero-day vulnerability in AnyDesk, tracked as CVE-2026-15682, allows local attackers to crash affected installations by manipulating the application’s Send Support Information feature. This flaw, discovered in the remote desktop tool’s diagnostic data-sharing function, enables threat actors to abuse filesystem junctions a type of reparse point to redirect file operations and write arbitrary files outside their intended locations.
The exploit forces AnyDesk or the underlying system into a denial-of-service (DoS) state, disrupting legitimate remote access for IT support teams and managed service providers. While the attack requires local code execution on the target machine, reducing its immediate remote exploitability, it poses a significant risk in shared, multi-user, or already compromised environments where low-privilege access is common.
This vulnerability follows a pattern seen in prior AnyDesk security issues, including a 2024 privilege escalation flaw that also leveraged reparse points. The company has faced repeated scrutiny over its security posture, particularly after a 2024 breach that led to certificate revocations and forced updates for users.
Security teams are advised to monitor AnyDesk’s official advisories for a patch addressing the junction-based file-write issue. Until a fix is released, mitigations include restricting low-privilege code execution on systems running AnyDesk and monitoring for unusual junction or reparse point activity. The flaw underscores ongoing risks in remote access tools, particularly for organizations reliant on them for critical IT operations.
Source: https://cybersecuritynews.com/anydesk-0-day-vulnerability/
AnyDesk TPRM report: https://www.rankiteo.com/company/anydesk-software-gmbh
"id": "any1784219253",
"linkid": "anydesk-software-gmbh",
"type": "Vulnerability",
"date": "7/2026",
"severity": "60",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'customers_affected': 'IT support teams, managed '
'service providers, '
'organizations reliant on '
'AnyDesk',
'industry': 'Remote Desktop/IT Support',
'name': 'AnyDesk',
'type': 'Software Vendor'}],
'attack_vector': 'Local code execution',
'description': 'A recently disclosed zero-day vulnerability in AnyDesk, '
'tracked as CVE-2026-15682, allows local attackers to crash '
'affected installations by manipulating the application’s Send '
'Support Information feature. This flaw, discovered in the '
'remote desktop tool’s diagnostic data-sharing function, '
'enables threat actors to abuse filesystem junctions (a type '
'of reparse point) to redirect file operations and write '
'arbitrary files outside their intended locations. The exploit '
'forces AnyDesk or the underlying system into a '
'denial-of-service (DoS) state, disrupting legitimate remote '
'access for IT support teams and managed service providers.',
'impact': {'brand_reputation_impact': "Ongoing scrutiny of AnyDesk's security "
'posture',
'downtime': 'Disruption of legitimate remote access',
'operational_impact': 'Disruption for IT support teams and managed '
'service providers',
'systems_affected': 'AnyDesk installations, underlying system'},
'lessons_learned': 'Ongoing risks in remote access tools, particularly for '
'organizations reliant on them for critical IT operations. '
'Need for improved security posture in remote desktop '
'applications.',
'post_incident_analysis': {'corrective_actions': 'Patch development by '
'AnyDesk, improved input '
'validation for filesystem '
'operations',
'root_causes': 'Abuse of filesystem '
'junctions/reparse points in '
'AnyDesk’s Send Support Information '
'feature'},
'recommendations': 'Monitor AnyDesk’s official advisories for a patch. '
'Restrict low-privilege code execution on systems running '
'AnyDesk. Monitor for unusual junction or reparse point '
'activity.',
'references': [{'source': 'AnyDesk Official Advisories'}],
'response': {'communication_strategy': 'Monitoring AnyDesk’s official '
'advisories',
'containment_measures': 'Restricting low-privilege code '
'execution on systems running AnyDesk, '
'monitoring for unusual junction or '
'reparse point activity',
'enhanced_monitoring': 'Monitoring for unusual junction or '
'reparse point activity',
'remediation_measures': 'Awaiting patch from AnyDesk'},
'title': 'New Zero-Day Flaw in AnyDesk Exploits Support Feature to Trigger '
'DoS Attacks',
'type': 'Denial-of-Service (DoS)',
'vulnerability_exploited': 'CVE-2026-15682 (filesystem junctions/reparse '
'point abuse in Send Support Information feature)'}