IM
IronMonkey Threat Research
‹ Back to ICS Advisories

ABB AbilityTM zenon Security Risk Due to High-Severity Vulnerabilities in WIBU CodeMeter Runtime

HIGH
CVSS 8.6
Date 2026-09-09T00:30:00+00:00
Source abb-psirt
Published by ABB PSIRT

// Description

ABB is aware of publicly disclosed security vulnerabilities affecting the WIBU-Systems CodeMeter Runtime for Windows, identified as CVE-2026-81572, CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576. The CodeMeter Runtime component is used within affected ABB zenon Software Platform installations for software licensing and license server functionality. Successful exploitation of the reported vulnerabilities could enable local privilege escalation on Windows systems and impact systems configured as CodeMeter license servers, potentially leading to unauthorized access, service disruption, or loss of system integrity. Refer to the WIBU-Systems advisory for detailed technical information on each vulnerability. Please see the References section for the WIBU-Systems security advisory.

// Vulnerabilities (5)

CVE ID CVSS Score Severity Description
CVE-2026-81575 7.5 high
CVE-2026-81575. If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.
CVE-2026-81576 7.7 high
CVE-2026-81576. If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
CVE-2026-81573 8.6 high
CVE-2026-81573. If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.
CVE-2026-81572 7.8 high
CVE-2026-81572. In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.
CVE-2026-81574 8.2 high
CVE-2026-81574. In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.

// Affected Products (2)

Vendor Product Asset Type Purdue Level Firmware
ABB Unknown rtu
L1
--
ABB Unknown rtu
L1
--

// Remediations (4)

Mitigation: ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to ver
ABB recommends the following mitigation measures: - Update the WIBU-Systems CodeMeter Runtime to version 8.41a or later. - The latest CodeMeter Runtime software is available from the WIBU-Systems download page: User Software - Wibu-Systems, please see the References section for the corresponding link. - Where upgrading is not feasible, ABB recommends that asset owners perform a risk assessment and implement compensating controls such as network isolation, access restrictions, and enhanced monitoring of affected systems. ABB recommends that customers apply the update at earliest convenience. The vulnerabilities associated with CVE-2026-81573, CVE-2026-81574, CVE-2026-81575 and CVE-2026-81576 are exploitable only when the WIBU-Systems CodeMeter Runtime is configured as a network server, which is not the de-fault configuration. The CVE-2026-81572 vulnerability requires local access to the affected Windows system and execution by a low-privileged user. Consequently, systems with restricted local access, proper privilege management, and limited network exposure are less likely to be successfully compromised. Refer to section “General security recommendations” for further advise on how to keep your system secure.
Patch: The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - Co
The problem is corrected by Wibu in the following product versions: - CodeMeter Runtime 8.41a - CodeMeter Runtime 9.10 ABB recommends that customers apply the update at earliest convenience. Both versions are available for download from the Wibu download site and can be updated independent of the tool installation: https://www.wibu.com/support/user/user-software.html An updated version of CodeMeter Runtime containing the fixes will be integrated into the following tool versions: - Automation Builder: Version 2.10.0 (expected by Q1/2027) - Drive Application Bulder: not planned, will be transferred to the Classic lifecycle phase end of Q3/2026 - Virtual Drive: Version 1.5.1 - Virtual DrivePlus: Version 1.70 (expected by Q4/2026)
Mitigation: Refer to section “General security recommendations” for further advise on how to keep your system se
Refer to section “General security recommendations” for further advise on how to keep your system secure.
Workaround: For CVE-2026-81572 the exposure can be limited by auditing the list of local users and removing any
For CVE-2026-81572 the exposure can be limited by auditing the list of local users and removing any unnecessary accounts. For CVE-2026-81573, CVE-2026-81574, CVE-2026-81575, and CVE-2026-81576: If you enabled the network server functionality at some point but no longer need it, disable it: - Open the Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ WIBUSYSTEMS\CodeMeter\Server\CurrentVersion\, then change the value of IsNetworkServerfrom 1 to 0. - Restart CodeMeter.

// References