CVE-2026-81576

Name of the Vulnerable Software and Affected Versions CodeMeter Runtime versions prior to 8.41a CodeMeter Runtime versions prior to 9.10

Description When configured as a server, the software issues handles per connection and uses a cryptographically weak SID (Session Identifier) as the only method of authentication. This allows an attacker to brute-force the SID, recover the handle number of another session, and read license information associated with that handle.

Recommendations Update CodeMeter Runtime to version 8.41a or later. Update CodeMeter Runtime to version 9.10 or later.