The popular remote desktop software AnyDesk contains a zero-day denial-of-service vulnerability that allows low-privileged attackers to disrupt or terminate active remote sessions without authentication. Tracked as CVE-2026-15682, the flaw was publicly disclosed on July 17, 2026, and affects multiple AnyDesk versions prior to the latest patched release.

Vulnerability Details (CVE-2026-15682)

Property	Value
CVE ID	CVE-2026-15682
Severity	Medium (Denial of Service)
Attack Vector	Network (remote)
Privileges Required	Low (standard user)
User Interaction	None
Affected Versions	AnyDesk < 9.0.2 (exact versions under investigation)
Patched Version	9.0.2+
Discoverer	Tamilselvan (CyberPress investigation)
Component	Session management / connection handling

According to the CyberPress investigation, the vulnerability stems from insufficient validation of session control messages in AnyDesk's connection protocol. An attacker with low-level network access (or who has compromised a low-privileged endpoint on the same network segment) can send specially crafted packets that trigger a resource exhaustion or state corruption condition in the AnyDesk client or server process, causing the remote session to freeze, disconnect, or crash entirely.

Technical Analysis

Attack Vector

The flaw resides in AnyDesk's session negotiation and keepalive mechanism. During an active remote session, the client and server exchange periodic control messages to maintain connection state, synchronize clipboard, handle input events, and manage display updates. The vulnerability occurs when the receiver processes a malformed session control message without proper bounds checking or state validation.

Root Cause (Inferred from Disclosure)

While full technical details are being withheld pending broader patch adoption, the disclosure indicates:

• Message type confusion: The parser misinterprets a crafted control message as a legitimate session termination or rekey request
• State machine violation: The session state transitions to an invalid state, triggering an unhandled exception or infinite loop
• Resource leakage: Each malformed message may leak a file descriptor, socket, or memory allocation, eventually exhausting per-process limits

This class of bug — protocol state machine flaws in remote access software — is particularly dangerous because it bypasses authentication entirely; the attacker only needs network reachability to the AnyDesk port (default TCP 6568) or the ability to inject traffic on the local network.

Proof-of-Concept Behavior

Researchers demonstrated that sending a sequence of malformed session control packets (approximately 50-200 bytes each) over an established AnyDesk connection causes:

1. Session freeze (10-30 seconds): Remote input/display stops updating
2. Automatic disconnect: AnyDesk terminates the session with "Connection lost" error
3. Client crash (in some versions): The AnyDesk process exits, requiring manual restart

No code execution or data leakage has been observed — this is a pure availability/denial-of-service issue. However, in operational contexts (IT support, industrial remote access, admin sessions), forced disconnection can disrupt critical workflows and may be used as a precursor to other attacks (e.g., disrupting an admin's response to a separate intrusion).

Impact Assessment

Who Is Affected

• IT support teams using AnyDesk for remote troubleshooting
• Managed Service Providers (MSPs) managing client endpoints
• Industrial/OT environments using AnyDesk for remote HMI/SCADA access
• Remote workers relying on AnyDesk for home-to-office connectivity
• AnyDesk self-hosted (on-prem) deployments — both client and server components

Business Risk

Scenario	Impact
Active admin session disrupted during incident response	High — delays containment/remediation
MSP managing 100+ endpoints simultaneously	High — mass session drops, SLA violations
Industrial remote maintenance session	Critical — potential safety/process interruption
Casual remote work session	Low-Medium — productivity loss, re-authentication required

Attacker Value

While CVE-2026-15682 is "only" a DoS, it provides attackers with:

• Blind disruption capability: No authentication, no user interaction needed
• Session hijacking facilitation: Force disconnect → race to re-authenticate with stolen credentials
• Operational cover: Mask other activities by flooding AnyDesk with disconnect packets

Mitigation & Patching

Immediate Actions

1. Update AnyDesk to 9.0.2 or later on all endpoints (client and server)
   • Download from anydesk.com — verify digital signature
   • Enable auto-update in Settings → Security → Automatic Updates
2. Restart AnyDesk service after update to ensure new code loads
3. Verify version via Help → About or anydesk --version

Network-Level Controls (if patching is delayed)

• Restrict AnyDesk port (TCP 6568) to trusted IP ranges only
• Enable AnyDesk's built-in access control list (ACL): Settings → Security → Access Control List → "Allow only specific IDs"
• Deploy IDS/IPS signatures for malformed AnyDesk protocol traffic (see detection section)
• Segment networks: Isolate AnyDesk traffic to dedicated management VLANs

Configuration Hardening

• Disable unattended access unless strictly required
• Require manual acceptance for all incoming connections
• Enable two-factor authentication for AnyDesk accounts (Settings → Security → Two-Factor Authentication)
• Log all session activity: Settings → Security → Log Connections

Detection Guidance

Network-Based Detection (Zeek/Suricata)

Windows Event Log Correlation

Monitor for Event ID 1000 (Application Error) or 1002 (Application Hang) with:

• Faulting Application Name: AnyDesk.exe
• Faulting Module Name: anydesk.dll or ntdll.dll
• Exception Code: 0xC0000005 (Access Violation) or 0xC00000FD (Stack Overflow)

Sigma Rule: AnyDesk Crash Pattern

Frequently Asked Questions

Q: Can this be exploited over the internet (WAN)?

A: Yes, if the AnyDesk client/server is directly exposed to the internet (not recommended). Most deployments use AnyDesk's relay infrastructure or are behind NAT/firewalls. Attackers would need network-level access to the target's AnyDesk listening port.

Q: Does this affect the AnyDesk mobile apps (iOS/Android)?

A: The disclosure focuses on the desktop client (Windows/macOS/Linux). Mobile apps use a different codebase but may share protocol logic. Update mobile apps as a precaution.

Q: Is there a CVE for the self-hosted AnyDesk server?

A: CVE-2026-15682 covers both client and server components since the flaw is in the shared session protocol. Update both.

Q: Can this be chained with other vulnerabilities?

A: A DoS forcing session termination could be combined with:

• Credential theft (keyloggers, phishing) to re-authenticate as the legitimate user
• MITM attacks if the attacker can intercept the reconnection attempt
• Social engineering ("Your session was disconnected due to a security update — please re-authenticate here")

Q: How was this discovered?

A: Investigative journalist Tamilselvan at CyberPress reported the finding on July 17, 2026, following responsible disclosure practices. The vendor was notified and released 9.0.2 promptly.

Key Takeaways

1. Patch immediately: AnyDesk 9.0.2 fixes a zero-day DoS that requires only network access and low privileges
2. Remote access tools are high-value targets: AnyDesk, TeamViewer, RDP, SSH — all need prompt patching and network segmentation
3. DoS is not "low risk" in operational contexts: Disrupting an admin's remote session during incident response has outsized impact
4. Monitor for crashes: Unexplained AnyDesk terminations may indicate exploitation attempts
5. Harden configuration: ACLs, 2FA, manual acceptance, and logging reduce the attack surface significantly

Conclusion

CVE-2026-15682 demonstrates that even "mere" denial-of-service flaws in remote access software warrant urgent attention. The combination of zero authentication, low privileges, and no user interaction makes this a practical weapon for disrupting IT operations, industrial maintenance, and incident response workflows. Organizations using AnyDesk should deploy 9.0.2 across their fleet today, enforce network segmentation for remote access traffic, and add detection rules for anomalous session terminations.

---

Sources:

• CyberPress: AnyDesk Zero-Day Flaw Lets Low-Privileged Attackers Trigger Denial-of-Service
• AnyDesk 9.0.2 Release Notes