Zero-Day Vulnerability CVE-2026-15682 in AnyDesk Enables Denial-of-Service Attacks on Affected Systems
A previously unknown zero-day vulnerability in AnyDesk has been identified that could allow attackers to cause denial-of-service conditions on affected installations of the widely used remote desktop software.
The issue, assigned the identifier CVE-2026-15682, resides in a component responsible for transmitting support-related information. Exploitation leverages a native Windows file system redirection capability that reroutes file operations to an alternate path, enabling an attacker with only limited local access to interfere with the AnyDesk service.
Successful exploitation can result in crashes of either the AnyDesk application itself or broader system instability. Given that AnyDesk is commonly deployed by technical support teams, managed service providers (MSPs), and corporate IT departments, such disruptions can directly impair remote troubleshooting, routine maintenance tasks, and time-sensitive incident response activities.
Security researchers note that the attack does not require elevated privileges beyond basic local access, making it particularly concerning in shared or multi-user environments where AnyDesk is installed.
Until a vendor-supplied fix is confirmed, organizations are strongly encouraged to implement the following mitigations:
- Restrict the ability of untrusted users to execute arbitrary code on systems running AnyDesk.
- Monitor for unusual creation or modification of file system redirection entries.
- Closely follow official communications from AnyDesk regarding patch availability.
- Apply updates immediately once a corrective patch is released.
Users and administrators should treat this vulnerability with high priority due to the tool’s critical role in remote operations across both enterprise and service-provider environments.
Related articles
ServiceNow Patches Multiple Critical Vulnerabilities in Now Platform and AI Platform
ServiceNow disclosed several critical vulnerabilities affecting the Now Platform and ServiceNow AI Platform on August 27. The issues include unauthenticated code injection via the GraphQL Composite Data API, improper access controls during system image uploads, and SQL injection flaws that allow arbitrary database queries. Four CVEs were published: CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. Exploitation of CVE-2026-18885 could permit remote code execution and data manipulation without authentication under certain conditions. CVE-2026-18886 enables unauthorized data creation, modification, and privilege escalation, while CVE-2026-74820 allows direct SQL execution against the underlying database. ServiceNow has released updated versions to address the flaws.
CISA Adds Linux Kernel Frag Gap Flaw and Two Other Exploited Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 27, 2026. One of the entries is CVE-2026-53362, a high-severity privilege escalation issue in the Linux kernel also known as Frag Gap. The flaw stems from an out-of-bounds write when generating IPv6 packets, allowing a low-privileged user to obtain root access. The Linux Kernel Organization assigned it a CVSS v3.1 base score of 7.8 and rated it High severity, with public exploit code already available. Federal agencies must remediate CVE-2026-53362 and CVE-2023-49105 by the August 30 deadline. The advisory underscores ongoing exploitation of these issues in the wild.
CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog Including Citrix NetScaler, Linux Kernel and Microsoft SQL Server Flaws
On August 26, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling confirmed active exploitation and requiring immediate remediation priority. The batch includes a recent memory corruption issue in Citrix NetScaler ADC and NetScaler Gateway tracked as CVE-2026-8452, along with five older flaws affecting Microsoft SQL Server, the Linux kernel, Ajax.NET Professional, Red Hat libuser, and Red Hat ABRT. Citrix released patches for the NetScaler vulnerability on June 30, 2026, while CISA set an August 29, 2026 deadline for federal agencies. Real-world attacks have already deployed web shells and performed reconnaissance after successful exploitation of the Citrix appliance. The remaining CVEs enable remote code execution, local privilege escalation, and denial-of-service conditions across widely deployed enterprise technologies.
Next.js Patches Two Critical RCE Vulnerabilities in Versions 15.5.24 and 16.3.3
Next.js has released security updates to address two critical vulnerabilities that could allow unauthenticated remote code execution. The fixes are available in versions 15.5.24 and 16.3.3. The first issue, tracked as CVE-2026-75604 with a CVSS score of 9.0, affects applications hosted on Windows servers using Pages Router or App Router without Cache Components and stems from a path traversal flaw. The second vulnerability impacts the Image Optimization API when processing malicious AVIF files, enabling code execution through crafted image inputs. Both flaws affect a wide range of versions from 10.0.0 and 13.4 onward. Administrators are advised to update immediately, rebuild containers, and verify production environments run the patched releases, especially on Windows systems and those handling user-uploaded images.