Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access

1. Executive summary

Researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk for Linux that grants root access before any connection is approved by the target user. AnyDesk fixed the flaw in version 8.0.3 in June 2026, but the changelog described the change only as "fixed a bug that could lead to a crash," no CVE was assigned, and no security advisory accompanied the release. EMEA financial services firms running AnyDesk on Linux endpoints, jump hosts, or remote-support workstations are exposed to unauthenticated root compromise for the window between the June fix and the present public exploit. No CVSS score, severity rating, or CISA KEV entry is available for this flaw in the verified reference data, so the risk below is assessed from the source description alone and should be treated as provisional.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The item describes a vulnerability disclosure and a public exploit; it does not itself constitute an ICT-related incident at a client, and the regulatory reference supplied does not include an article whose trigger is met by a vendor patch disclosure alone. If a client confirms exploitation of this flaw on its own estate, DORA Art. 17 (ICT-related incident management process) and DORA Art. 19 (reporting of major ICT-related incidents to competent authorities) become engaged by the resulting incident, and NIS2 Art. 23 (incident reporting obligations) applies to in-scope entities. Those are contingent on a client-side incident, not on this advisory.

3. Technical analysis & attack chain

The source is a short news item. It confirms the vulnerability class, the affected platform, the fixed version, and the existence of a public working exploit. It does not name the CVE, the vulnerable component, the protocol or port involved, the exploit's mechanics, or any post-exploitation behaviour. The attack chain below is limited to what the source states; steps that a defender would normally expect (payload delivery, persistence, C2) are not described and are marked as such rather than inferred.

Confirmed steps:

1. An attacker reaches an AnyDesk for Linux endpoint over the network. The source describes the flaw as pre-authentication remote code execution, meaning the attacker does not need valid credentials and does not need the target user to approve an incoming connection.
2. The attacker exploits the flaw to execute code. The source states the result is root access, so the code runs with the privileges of the AnyDesk service rather than the desktop user.
3. No user interaction step is present in the source. The source explicitly notes the compromise occurs "before anyone approves the connection," which removes the usual AnyDesk consent prompt as a control.

What the source does not provide: the CVE identifier, the affected AnyDesk Linux versions below 8.0.3, the specific component or function that is vulnerable, the network port or protocol the exploit uses, the exploit's technical mechanism, any payload or implant, persistence, privilege escalation beyond the initial root grant, command-and-control, lateral movement, or data access. Any advisory that fills those gaps is inventing detail.

The fix and its disclosure gap are the operationally significant facts. AnyDesk shipped the fix in version 8.0.3 in June 2026. The changelog entry read "fixed a bug that could lead to a crash." No CVE was assigned and no security advisory was published. That means organisations that track vendor security advisories or CVE feeds would not have seen this flaw, and organisations that patch on a security-advisory cadence rather than a version cadence may still be running a vulnerable build. The public exploit was published on or before 2026-10-09, the date of the source.

Confidence caveat: this advisory rests on a single source, a news item at The Hacker News. The vulnerability class, the fixed version, and the changelog wording are single-sourced and have not been corroborated against a vendor advisory, a CVE record, or a second independent report. Treat the technical specifics as provisional until AnyDesk or a CVE record confirms them.

The related source in the corpus (GHSA-6rh7-pjg5-mhwh, an improper symlink resolution flaw in Plesk allowing authenticated users to execute code as root) is a separate product and a separate vulnerability. It is not part of this attack chain and is not referenced further.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory AnyDesk for Linux installations across endpoints, jump hosts, and remote-support workstations. Confirm the installed version on each. Any build below 8.0.3 is exposed to the published exploit.
• Upgrade AnyDesk for Linux to 8.0.3 or later. The source names 8.0.3 as the fixed version. Where a host cannot be upgraded immediately, disable the AnyDesk service on that host until it can be.
• Where AnyDesk is not required on a Linux host, uninstall it. Remote-support tooling that is not needed is attack surface with no offsetting benefit.
• Restrict network reachability to AnyDesk listeners on Linux hosts. The source does not state the port or protocol, so confirm the listening port on a representative host and limit inbound access to the management or support networks that genuinely need it. Do not assume the default port without checking.
• Search endpoint and network telemetry for AnyDesk process activity on Linux hosts that does not correspond to a scheduled or user-initiated support session, particularly sessions that began without a corresponding user approval event.

P2 (within 72 hours)

• Add AnyDesk for Linux to the vulnerability management feed as a version-checked item rather than a CVE-checked item. This flaw had no CVE at disclosure, so CVE-driven scanning would have missed it. The same gap will recur with other vendors that ship silent security fixes.
• Review the change-management record for the June 2026 AnyDesk 8.0.3 rollout. Determine which Linux hosts were in scope, which were deferred, and which were never scheduled. The deferred and unscheduled sets are the priority for P1.
• Where AnyDesk for Linux runs as a service, confirm the service account and its privileges. The source states the exploit yields root, so the service is running with sufficient privilege to reach root. Reducing that privilege is a defence-in-depth change, not a fix for this flaw.

P3 (within 7 days)

• Amend vendor patch procedures so that "fixed a crash" changelog entries from remote-access vendors trigger a version review rather than being closed as non-security. The disclosure gap here was the changelog wording, not the fix.
• Confirm that remote-support tooling on Linux is covered by the same patch SLA as Windows and macOS endpoints. Cross-platform support tools are frequently patched on the primary platform's cadence and lag on the others.

5. Indicators of compromise

No indicators of compromise available in the source material. The source names no hashes, domains, IP addresses, file paths, registry keys, or command-line strings. It describes the vulnerability class and the fixed version only.

Behavioural indicators, from the source's description of the flaw:

No copyable indicator block is provided because the source contains no atomic indicators.

6. Detection

Insufficient indicators to author detection rules. The source provides no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file paths, registry keys, or hard-coded values. It names the product and the fixed version, which are not threat artefacts and would produce rules that match reporting about the flaw rather than the flaw itself. A version-check control (AnyDesk for Linux below 8.0.3) is the appropriate detection here, and it belongs in inventory tooling, not in a YARA or Sigma rule.

7. Sources

• The Hacker News, "Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access," https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html, 2026-10-09.
• GitHub Security Advisories, "Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root," https://github.com/advisories/GHSA-6rh7-pjg5-mhwh, date not stated. Separate product and vulnerability; not part of this attack chain.

8. Adverse Trace position

Adverse Trace assesses this as a high-priority patch item for any EMEA financial services client running AnyDesk for Linux, on the basis of the source's description of unauthenticated root access and the existence of a public working exploit. We are not assigning a CVSS score or severity rating: the verified reference data contains no CVSS value, no severity, and no CISA KEV entry for this flaw, and we will not manufacture one from a news item. The disclosure gap is the part clients should act on regardless of the score. A security fix shipped in June 2026 under a crash-bug changelog entry, with no CVE and no advisory, means CVE-driven scanning and advisory-driven patching both missed it for four months. We will attempt to corroborate the vulnerability class, the affected version range, and the fixed version against an AnyDesk advisory or a CVE record, and we will issue a follow-up if the vendor confirms details that change the mitigation. Clients who cannot confirm their AnyDesk for Linux version across the estate should treat every Linux host running AnyDesk as exposed until they can.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.