ABB AbilityTM zenon Security Risk Due to High-Severity Vulnerabilities in WIBU CodeMeter Runtime
ABB is aware of publicly disclosed security vulnerabilities affecting the WIBU-Systems CodeMeter Runtime for Windows, identified as CVE-2026-81572, CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576. The CodeMeter Runtime component is used within affected ABB zenon Software Platform installations for software licensing and license server functionality. Successful exploitation of the reported vulnerabilities could enable local privilege escalation on Windows systems and impact systems configured as CodeMeter license servers, potentially leading to unauthorized access, service disruption, or loss of system integrity. Refer to the WIBU-Systems advisory for detailed technical information on each vulnerability. Please see the References section for the WIBU-Systems security advisory.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-81576US | — | — | ||
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator. An attac… | ||||
| CVE-2026-81575US | — | — | ||
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and
the data itself. Missing bounds che… | ||||
| CVE-2026-81574US | — | — | ||
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
specifiers. Thi… | ||||
| CVE-2026-81573US | —OT elevated | — | ||
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-
origin restrictions. Commands intended only for loc… | ||||
| CVE-2026-81572US | — | — | ||
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The… | ||||
references
External citations — patches, advisories, analysis.
remediations (5)
- MitigationWIBU-Systems CodeMeter Runtime <8.41a installed with ABB AbilityTM zenon <=14
ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationWIBU-Systems CodeMeter Runtime <8.41a installed with ABB AbilityTM zenon <=14
ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationWIBU-Systems CodeMeter Runtime <8.41a installed with ABB AbilityTM zenon <=14
ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationWIBU-Systems CodeMeter Runtime <8.41a installed with ABB AbilityTM zenon <=14
ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationWIBU-Systems CodeMeter Runtime <8.41a installed with ABB AbilityTM zenon <=14
ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan