Executive Summary

On October 8th, 2026, the security research team V12 published a working exploit for a critical vulnerability in AnyDesk for Linux. Tracked as CVE-2026-109390, the flaw lets an unauthenticated, remote attacker execute commands as root by sending crafted session traffic to the AnyDesk service. AnyDesk versions before 8.0.3 are affected, and AnyDesk states that Windows and macOS are not vulnerable to this attack.

AnyDesk is remote access software used for IT support and unattended administration, and on Linux its service normally runs as root. AnyDesk fixed the flaw in version 8.0.3 in June 2026, but its changelog described the change only as a crash fix, and no CVE was assigned until October.

Because a working exploit is now public, Beazley Security expects threat actors to develop and deploy weaponized exploits soon. Given unauthenticated root-level access, a public exploit, and the trusted position remote access tools hold on servers, Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Product

Affected Versions

Fixed Versions

AnyDesk for Linux

8.0.0 through 8.0.2

8.0.3 and later (8.1.0 is the current release)

Mitigations / Workarounds

AnyDesk fixed the vulnerability in AnyDesk for Linux 8.0.3, and upgrading to 8.0.3 or later is the only complete remediation. AnyDesk has not issued a formal security advisory for the flaw and states the issue is limited to direct connections on Linux that do not pass through its relay servers.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

  • Block inbound TCP port 7070 from untrusted networks at host firewalls, perimeter firewalls, VPN gateways, and cloud security groups. The public exploit uses direct connections on this port.

  • Stop and disable the AnyDesk service on Linux hosts that do not need it until they can be upgraded.

Patches

AnyDesk released the fix in AnyDesk for Linux 8.0.3 in June 2026 and recorded it in its Linux changelog as a fix for "a bug that could lead to a crash." Version 8.1.0 is the current release and is available from the AnyDesk download page. Windows and macOS installations require no action for this flaw, according to AnyDesk.

Technical Details

CVE-2026-109390, which its finders call "AnyPwn", was discovered by Rick de Jager of the V12 security team. V12 announced the flaw on June 22nd, 2026, and AnyDesk shipped the fix in version 8.0.3. V12 security released full technical details and a working exploit on GitHub on October 8th, 2026.

The flaw sits in the stream packet handler of the AnyDesk session protocol and the handler trusts a payload length supplied by the remote peer before checking that it fits within the received frame resulting in a heap buffer overflow RCE. A detailed write up of the exploit has been provided in the V12 security link above, and the current public proof-of-concept (PoC) targets AnyDesk for Linux 8.0.2 on x86_64 running in service mode (anydesk --service).

The attacker only needs network access to the AnyDesk service, and the attack completes before the victim is asked to approve desktop control. Because the service normally runs as root on Linux, successful exploitation yields root command execution. V12 security has not demonstrated the exploit against other builds, although the researchers suggest prior AnyDesk versions would require different offsets to exploit.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.

Sources