CVE-2026-81573

highpriority · track · 0OT risk · elevatedEPSS 0.004 · 33 %ileCHDENL
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.40% (33rd) EPSS
CVSS 8.6 · high
Is it mine?
153 products
Check your exposure
Who says so?
5 sources
abb_psirt · cert_bund · ncsc_nl · sick_psirt

EPSS · scored 2026-10-22

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedAutomation Builderabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at earliest convenience. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - Automation Builder: Version 2.10.0 (expected by Q1/2027) - Drive Application Bulder: not planned, will be transferred to the Classic lifecycle phase end of Q3/2026 - Virtual Drive: Version 1.5.1 - Virtual DrivePlus: Version 1.70 (expected by Q4/2026)

  • FixedDrive Application Bulderabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at earliest convenience. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - Automation Builder: Version 2.10.0 (expected by Q1/2027) - Drive Application Bulder: not planned, will be transferred to the Classic lifecycle phase end of Q3/2026 - Virtual Drive: Version 1.5.1 - Virtual DrivePlus: Version 1.70 (expected by Q4/2026)

  • FixedVirtual Driveabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at earliest convenience. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - Automation Builder: Version 2.10.0 (expected by Q1/2027) - Drive Application Bulder: not planned, will be transferred to the Classic lifecycle phase end of Q3/2026 - Virtual Drive: Version 1.5.1 - Virtual DrivePlus: Version 1.70 (expected by Q4/2026)

  • FixedVirtual Drive Plusabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at earliest convenience. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - Automation Builder: Version 2.10.0 (expected by Q1/2027) - Drive Application Bulder: not planned, will be transferred to the Classic lifecycle phase end of Q3/2026 - Virtual Drive: Version 1.5.1 - Virtual DrivePlus: Version 1.70 (expected by Q4/2026)

  • FixedAC 800PECabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at their earliest convenience and install the version compatible with their operating system. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html. An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - AC 800PEC: Version 5.4.5.2 - AC 800PEC ARM: Version 3.0.0.0 (Expected by Q1 2027) - AC 800PEC Tool: Not planned, in classic lifecycle phase - AC 800PEC Tool Cheetah: Version 3.0.0.0 (Expected by Q1 2027) - Control Terminal (xCT): Not planned, in classic lifecycle phase

  • FixedAC 800PEC ARMabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at their earliest convenience and install the version compatible with their operating system. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html. An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - AC 800PEC: Version 5.4.5.2 - AC 800PEC ARM: Version 3.0.0.0 (Expected by Q1 2027) - AC 800PEC Tool: Not planned, in classic lifecycle phase - AC 800PEC Tool Cheetah: Version 3.0.0.0 (Expected by Q1 2027) - Control Terminal (xCT): Not planned, in classic lifecycle phase

  • FixedAC 800PEC Toolabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at their earliest convenience and install the version compatible with their operating system. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html. An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - AC 800PEC: Version 5.4.5.2 - AC 800PEC ARM: Version 3.0.0.0 (Expected by Q1 2027) - AC 800PEC Tool: Not planned, in classic lifecycle phase - AC 800PEC Tool Cheetah: Version 3.0.0.0 (Expected by Q1 2027) - Control Terminal (xCT): Not planned, in classic lifecycle phase

  • FixedAC 800PEC Tool Cheetahabb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at their earliest convenience and install the version compatible with their operating system. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html. An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - AC 800PEC: Version 5.4.5.2 - AC 800PEC ARM: Version 3.0.0.0 (Expected by Q1 2027) - AC 800PEC Tool: Not planned, in classic lifecycle phase - AC 800PEC Tool Cheetah: Version 3.0.0.0 (Expected by Q1 2027) - Control Terminal (xCT): Not planned, in classic lifecycle phase

  • FixedControl Terminal (xCT)abb_psirt

    The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at their earliest convenience and install the version compatible with their operating system. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html. An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - AC 800PEC: Version 5.4.5.2 - AC 800PEC ARM: Version 3.0.0.0 (Expected by Q1 2027) - AC 800PEC Tool: Not planned, in classic lifecycle phase - AC 800PEC Tool Cheetah: Version 3.0.0.0 (Expected by Q1 2027) - Control Terminal (xCT): Not planned, in classic lifecycle phase

  • Fixedtrumpf_psirt

    An updated Wibu Codemeter Runtime is available for download. If your installation is affected, the easiest fix is to install the latest Runtime from https://www.wibu.com/support/user/user-software.html

  • FixedCODE-LOCsick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedLiDAR-LOCsick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU0G00 with Image Version 1.0.0.2 and Image ID 38sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU0G00 with Image Version 1.0.0.7 and Image ID 30sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU0G03 with Image Version 1.0.0.1 and Image ID 41sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU0G03 with Image Version 1.0.0.2 and Image ID 36sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU0G50 with Image Version 1.0.0.1 and Image ID 45sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU0G50 with Image Version 1.0.0.2 and Image ID 38sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU3F00 with Image Version 1.0.0.0 and Image ID 27sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU3F00 with Image Version 1.0.0.0 and Image ID 46sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU4600 with Image Version 1.1.0.1 and Image ID 18sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU8G00 with Image Version 1.0.0.11 and Image ID 15sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU8G00 with Image Version 1.0.0.2 and Image ID 44sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU8G20 with Image Version 1.0.0.2 and Image ID 29sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSICK APU8G20 with Image Version 1.0.0.2 and Image ID 32sick_psirt

    Customers are strongy recommended to update the Codemeter Runtime to the latest version (>= 9.10). The software can be downloaded directly on the Wibu Systems website: https://www.wibu.com/de/support/anwendersoftware/anwendersoftware.html

  • FixedSentio Creatorsick_psirt

    Users are recommended to upgrade to version 2026.3.

  • MitigationWIBU-Systems CodeMeter Runtime <8.41a installed with ABB AbilityTM zenon <=14abb_psirt

    ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationAutomation Builderabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationDrive Application Bulderabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationVirtual Driveabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationVirtual Drive Plusabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationAC 800PECabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationAC 800PEC ARMabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationAC 800PEC Toolabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationAC 800PEC Tool Cheetahabb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationControl Terminal (xCT)abb_psirt

    Refer to section “General security recommendations” for further advise on how to keep your system secure.

  • MitigationSICK SIM1200-2A1A130 LiDAR-LOC with all firmware versionssick_psirt

    Please make sure that only trusted entities have access to the device. Furthermore, you should apply the following General Security Measures when operating the product to mitigate the associated security risk. The collected resources "SICK Operating Guidelines" and "ICS-CERT recommended practices on Industrial Security" could help to implement the general security practices.

  • WorkaroundAutomation Builderabb_psirt

    For CVE-2026-81572 the exposure can be limited by auditing the list of local users and removing any unnecessary accounts. For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundDrive Application Bulderabb_psirt

    For CVE-2026-81572 the exposure can be limited by auditing the list of local users and removing any unnecessary accounts. For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundVirtual Driveabb_psirt

    For CVE-2026-81572 the exposure can be limited by auditing the list of local users and removing any unnecessary accounts. For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundVirtual Drive Plusabb_psirt

    For CVE-2026-81572 the exposure can be limited by auditing the list of local users and removing any unnecessary accounts. For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundAC 800PECabb_psirt

    For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundAC 800PEC ARMabb_psirt

    For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundAC 800PEC Toolabb_psirt

    For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundAC 800PEC Tool Cheetahabb_psirt

    For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundControl Terminal (xCT)abb_psirt

    For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

  • WorkaroundSICK SIM1200-2A1A130 LiDAR-LOC with all firmware versionssick_psirt

    Customers should block unauthorized access to ports 22350 and 22352.

02

cvss

Technical severity, 0–10. One row per scoring source.

8.6
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Lsecondaryexploitability 3.9 · impact 4.7
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Lsecondary · SICK PSIRT DE
v3.17.9highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L/E:Usecondary · CVSS-BT (t0sche)
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L/RC:Csecondary · ABB PSIRT
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Lsecondary · TRUMPF PSIRT
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Lsecondary · NCSC-NL NL
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284USCWE-284USCWE-59USCWE-862US
05

affected products (153)

Products and version ranges known to be affected.

showing 20 of 153
06

advisories (7)

Vendor and ecosystem advisories describing this.

  • 2NGA003144ABB AbilityTM zenon Security Risk Due to High-Severity Vulnerabilities in WIBU CodeMeter Runtime2026-09-09csaf · abb_psirtCH

    ABB is aware of publicly disclosed security vulnerabilities affecting the WIBU-Systems CodeMeter Runtime for Windows, identified as CVE-2026-81572, CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576. The CodeMeter Runtime component is used within affected ABB zenon Software Platform installations for software licensing and license server functionality. Successful exploitation of the reported vulnerabilities could enable local privilege escalation on Windows systems and impact systems configured as CodeMeter license servers, potentially leading to unauthorized access, service disruption, or loss of system integrity. Refer to the WIBU-Systems advisory for detailed technical information on each vulnerability. Please see the References section for the WIBU-Systems security advisory.

  • 3ADR011572Automation Builder, Drive Application Builder, Virtual Drive, Virtual DrivePlus Impacted by multiple vulnerabilities in Wibu CodeMeter2026-09-03csaf · abb_psirtCH

    An update is available that resolves publicly reported vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could - allow arbitrary files to be deleted with system privileges (CVE-2026-81572), - read potentially sensitive configuration data and overwrite selected values in Server.ini (CVE-2026-81573), - crash CodeMeter and disclose sensitive information such as process memory and stack canaries (CVE-2026-81574), - crash CodeMeter (CVE-2026-81575), or - read potentially sensitive license information (CVE-2026-81576)

  • 3BHS973333AC 800PEC, AC 800PEC ARM, AC 800PEC Tool, Control Terminal (xCT) and AC 800PEC Tool Cheetah Impacted by multiple vulnerabilities in Wibu CodeMeter2026-09-10csaf · abb_psirtCH

    An update is available that resolves a publicly reported vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited these vulnerabilities could - Allow arbitrary files to be deleted with system privileges (CVE-2026-81572), - Read potentially sensitive configuration data and overwrite selected values in Server.ini (CVE-2026-81573) - Crash CodeMeter and disclose sensitive information such as process memory and stack canar-ies (CVE-2026-81574) - Crash CodeMeter (CVE-2026-81575), or - Read potentially sensitive license information (CVE-2026-81576)

  • NCSC-2026-0333Kwetsbaarheden verholpen in CodeMeter Runtime van Wibu-SystemsNL2026-08-28csaf · ncsc_nlNL

    Wibu-Systems heeft meerdere kwetsbaarheden verholpen in CodeMeter Runtime.

  • VDE-2026-091TRUMPF: Multiple products affected by Wibu CodeMeter vulnerabilities2026-09-15csaf · trumpf_psirtDE

    The TRUMPF product versions listed below include a Wibu CodeMeter Runtime version that contains several vulnerabilities, e.g. potentially allowing privilege escalation.

  • WID-SEC-W-2026-3004Wibu-Systems CodeMeter Runtime: Mehrere SchwachstellenDeutsch2026-08-25csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Wibu-Systems CodeMeter Runtime ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Berechtigungen zu erweitern und Administratorrechte zu erlangen oder Denial-of-Service-Zustände herbeizuführen.

  • sca-2026-0011Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products2026-09-04csaf · sick_psirtDE

    Several vulnerabilities in the Wibu Systems CodeMeter Runtime affect the SICK products Sentio Creator, Sentio Compose, Safety Designer, Stream Editor, CODE-LOC, LiDAR-LOC, PLB, SIM1200-2A1A130 LiDAR-LOC and multiple SICK Industrial PCs (APU0G00, APU0G50, APU0G03, APU3F00, APU4600, APU8G00 and APU8G20), which ship with CodeMeter Runtime as part of their preinstalled image. For Sentio Compose, Safety Designer, Stream Editor and PLB, only CVE-2026-81572 is relevant. Vulnerabilities requiring the CodeMeter Runtime to be configured as a server are not applicable to default Sentio Compose, Safety Designer, Stream Editor and PLB installations, as the runtime is shipped with the Network Server and CmWAN Server functionalities disabled. Customers who have modified the default configuration and enabled CodeMeter server functionality should review the remaining vulnerabilities for potential impact. The vulnerabilities could potentially affect the integrity, confidentiality, and availability of the affected products.

07

sources

Which sources assert this record, and when.

abb_psirtcert_bundncsc_nlsick_psirttrumpf_psirtNVDCVE.orgMITRE
published 2026-08-27modified 2026-09-01
08

references (1) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan