CVE-2026-109390

No known exploitation. No EPSS score yet. Fixed in 8.0.3.

CVSS 3.19.8Critical EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix8.0.3Upgrade to this build

Published 2026-10-12Updated 2026-10-13Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

AnyDeskAffected: ≥ 8.0.0, < 8.0.3Upgrade to: 8.0.3Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which version of AnyDesk is installed on every machine that uses it.
If the version is earlier than 8.0.3, treat it as affected and prioritize the update.
Update AnyDesk to version 8.0.3 or later on all devices, especially any Linux systems running it as a service.
Restart the AnyDesk service/application after updating to confirm the new version is active.
If you cannot update immediately, restrict network access to the AnyDesk service until you can.

Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

In plain language

Written by AI from the record

A serious flaw in AnyDesk (before version 8.0.3) lets an attacker take over a computer remotely without needing a password or any click from the user, so you should update it as soon as possible.

Unauthenticated remote code execution in AnyDesk versions before 8.0.3 via a heap-based buffer overflow caused by an unvalidated payload length in the mode 5 stream packet handler of the session protocol, demonstrated as root command execution on Linux without victim approval.

If you're affected

Full system takeover
Remote access without login
Root-level command execution
Operational disruption
Data theft or ransomware entry point

What is it

AnyDesk is remote-access software that lets someone connect to and control a computer from another location. This flaw is like leaving a side door unlocked that anyone on the internet can walk through — they don't need a key (password) or your permission, and once inside they can take full control of the machine, including as the most powerful user on Linux systems.

Who is affected

This matters to you if you or your staff use AnyDesk to remotely access or support computers, especially on Linux machines where AnyDesk runs as a service. It affects any installation running a version earlier than 8.0.3, and is a risk if that AnyDesk instance is reachable over the network — no login or user approval is needed for an attacker to exploit it.

How urgent is it

There is no evidence yet of attackers actively exploiting this flaw in the wild, and no public exploit code has surfaced — this is not yet a confirmed active-attack situation. However, because it allows full takeover without any login or user interaction, you should not delay: update affected systems promptly rather than waiting for signs of attack.

What to do — in detail

Inventory all AnyDesk installations across your environment, with particular attention to Linux hosts where AnyDesk may run unattended as a background service.
Confirm installed version via the AnyDesk client/service version check; anything below 8.0.3 is vulnerable.
Upgrade to AnyDesk 8.0.3 or later across all platforms (Windows, macOS, Linux) — there is no indication of breaking changes tied to this fix.
If immediate patching isn't possible, restrict or firewall off network reachability to the AnyDesk listening port/service as a temporary mitigation, since the flaw is remotely triggerable without authentication.
No CISA KEV listing and no public exploit exist at this time, so there is no mandated remediation deadline — but given the CVSS 9.8 severity and unauthenticated RCE impact, treat this as high-priority patching, not routine maintenance.
Monitor AnyDesk release notes and vendor advisories for any update indicating active exploitation, which would elevate urgency.

Technical context

CVSS 3.1 score is 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, no privileges or user interaction required, full impact to confidentiality, integrity, and availability. The weakness is CWE-130 (improper handling of length parameter), manifesting as a heap-based buffer overflow in the mode 5 stream packet handler of AnyDesk's session protocol due to unvalidated payload length, demonstrated on Linux leading to root-level command execution. Not listed in CISA KEV and no public exploit code is currently on record, indicating exploit maturity is theoretical/PoC-stage at most; treat as high-severity but not yet confirmed under active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.

Lifecycle

4 events over 1 day, from the signal feeds we watch.

2026-10-13Record updated
2026-10-12Publishedweakness classified, record updated

Affected products

AnyDeskcommercial · DEaka any desk
- AnyDeskSaaSCommunications

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-130No name in the record

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for AnyDesk, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account