--- title: "CVE-2026-109390: Critical AnyDesk Linux RCE - What It Is and How to Respond" description: "CVE-2026-109390 lets attackers run code as root on AnyDesk for Linux before 8.0.3. Affected versions, fix steps and detection tips." url: "https://www.gowrishankar.me/blog/cve-2026-109390-critical-anydesk-linux-rce-what-it-is-and-how-to-respond" author: "Gowri Shankar Balasubramaniam" published: 2026-10-19T10:18:56.548Z category: "Vulnerability Analysis" tags: ["AnyDesk","AnyDesk Linux RCE","AnyDesk vulnerability","AnyPwn","CVE-2026-109390","Critical Vulnerability","Heap Buffer Overflow","Linux Security","Patch Management","Remote Access Security","Remote Code Execution","Vulnerability Management","check AnyDesk version Linux","how to fix AnyDesk CVE-2026-109390","is AnyDesk safe to use on Linux"] --- # CVE-2026-109390: Critical AnyDesk Linux RCE - What It Is and How to Respond > CVE-2026-109390 is a critical (CVSS 9.8) flaw in AnyDesk for Linux 8.0.0–8.0.2 that lets unauthenticated attackers run code as root. Public exploit code is available. Learn which versions are affected, how to patch to 8.0.3, and how to detect signs of compromise. ## Key takeaways - CVE-2026-109390 is a critical (CVSS 9.8) pre-authentication RCE in AnyDesk for Linux 8.0.0–8.0.2. - Attackers can run code as root without credentials or user approval. - Public exploit code ("AnyPwn") was released on 8 October 2026; no confirmed in-the-wild exploitation yet. - Upgrade Linux to 8.0.3 or later (8.1.0 recommended); Windows to 9.7.8+ and macOS to 9.7.2+. - Blocking TCP 7070 only reduces exposure — relay connections may still reach the flaw. - The fix shipped silently in June 2026, so CVE-driven scanners missed it for months. **CVE-2026-109390 is a critical (CVSS 9.8) pre-authentication remote code execution (RCE) flaw in AnyDesk for Linux versions 8.0.0 to 8.0.2.** An attacker who can reach the AnyDesk service over the network can run code as root, with no credentials and no click from the user. This guide explains what the AnyDesk Linux RCE is and how to respond: update to AnyDesk for Linux 8.0.3 or later now, because working exploit code is public. - **Affected:** AnyDesk for Linux 8.0.0 up to (not including) 8.0.3 - **Fixed in:** 8.0.3 (released June 2026); 8.1.0 is the current Linux release - **Exploit status:** public proof-of-concept ("AnyPwn"); no confirmed in-the-wild exploitation and not in the CISA KEV catalogue as of 19 October 2026 - **Windows and macOS:** AnyDesk recommends updating to 9.7.8+ (Windows) and 9.7.2+ (macOS) as a precaution ## What is CVE-2026-109390? [CVE-2026-109390]() is a heap-based buffer overflow in the AnyDesk session protocol, reachable before any authentication. In the stream packet handler for mode 5, a payload length supplied by the attacker is not validated before it is used in a memory allocation. A crafted packet can therefore write attacker data past the allocated buffer and hijack execution ([CVE record]()). On Linux, the AnyDesk service (`anydesk --service`) normally runs as root and listens on TCP 7070 for direct connections. Successful exploitation gives full control of the host without the user ever approving a desktop session. | Attribute | Detail | | --- | --- | | CVE | CVE-2026-109390 (published 12 October 2026) | | Severity | CVSS v3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) | | Weakness | Heap-based buffer overflow; unvalidated length field (CWE-130) | | Attack vector | Network, unauthenticated, no user interaction | | Impact | Arbitrary code execution, as root when AnyDesk runs as a system service | | Public exploit | Yes — "AnyPwn" PoC released by V12 Security on 8 October 2026 | Notably, the fix shipped silently in June 2026, almost four months before the CVE was assigned. Vulnerability scanners that rely on CVE feeds could not flag the issue during that window. ![Diagram of the CVE-2026-109390 attack chain: an unauthenticated attacker reaches the AnyDesk root service via TCP 7070 or relay, triggers a heap overflow and executes code as root]() ## Which AnyDesk versions are affected? Linux installations from 8.0.0 up to 8.0.2 are vulnerable; Windows and macOS share the underlying flaw but have no known exploitation. | Platform | Affected | Minimum safe version | Urgency | | --- | --- | --- | --- | | Linux | 8.0.0 – 8.0.2 | 8.0.3 (8.1.0 recommended) | Immediate — public PoC | | Windows | Earlier than 9.7.8 | 9.7.8 | Precautionary | | macOS | Earlier than 9.7.2 | 9.7.2 | Precautionary | The public PoC targets 8.0.2 specifically, but the official affected range covers all of 8.0.0–8.0.2. Treat every Linux host below 8.0.3 as exposed. ![Table of AnyDesk versions affected by CVE-2026-109390: Linux 8.0.0–8.0.2 fixed in 8.0.3, Windows fixed in 9.7.8, macOS fixed in 9.7.2]() ## Why this vulnerability matters The combination of root privileges, no authentication and public exploit code makes this a patch-now issue, not a next-cycle item. - **Root by default.** Remote access tools run as privileged services, so one exploit yields full host compromise: credential theft, persistence and lateral movement. - **Large exposed footprint.** Qi-AnXin CERT counted roughly 21,500 internet-reachable AnyDesk assets globally linked to this flaw ([source]()). - **Firewalling port 7070 is not a full fix.** Qi-AnXin reports the vulnerable code path is also reachable through AnyDesk relay connections, so blocking direct traffic reduces exposure but does not remove it. - **Ransomware precedent.** Remote-access software is a favoured initial-access vector; a weaponised PoC typically shortens the time to mass exploitation. - **Compliance impact.** For PCI DSS environments, Requirement 6.3.3 expects critical patches within one month; a public PoC justifies a far shorter internal SLA. Remote-access tooling in the cardholder data environment also falls under Requirement 8 controls. ## How to fix CVE-2026-109390: step by step Upgrading to AnyDesk for Linux 8.0.3 or later is the only complete fix; everything else is temporary risk reduction. 1. **Inventory every AnyDesk install.** Check version and exposure on each Linux host: ```bash anydesk --version sudo ss -tlnp | grep ':7070' ``` 2. **Upgrade from the official source only.** Use the AnyDesk repository or [anydesk.com/downloads](), then restart the service: ```bash # Debian / Ubuntu sudo apt update && sudo apt install --only-upgrade anydesk # RHEL / Fedora / Rocky sudo dnf upgrade anydesk sudo systemctl restart anydesk anydesk --version # confirm 8.0.3 or later ``` 3. **If you cannot patch today, restrict TCP 7070.** Allow only trusted management ranges, then deny the rest (ufw evaluates rules in order): ```bash sudo ufw allow from 10.20.0.0/24 to any port 7070 proto tcp sudo ufw deny 7070/tcp ``` Replace the subnet with your own admin network. Remember that relay connections may still reach the flaw. 4. **Remove what you do not need.** Uninstall AnyDesk from servers where it is not business-critical, or stop the service until patched (`sudo systemctl disable --now anydesk`). 5. **Hunt for signs of compromise.** Review unexpected `anydesk` service crashes or restarts (`journalctl -u anydesk`), unusual child processes spawned by the AnyDesk process, new root-owned cron jobs, SSH keys or systemd units, and the trace log at `/var/log/anydesk.trace`. Compare findings with the indicators in the official AnyDesk Trust Center advisory. 6. **Patch Windows and macOS clients too.** Move to 9.7.8+ and 9.7.2+ respectively in the next maintenance window. 7. **Close the governance gap.** Add remote-access tools to your asset inventory and vendor changelog monitoring, since this fix shipped months before a CVE existed. ![Five-step CVE-2026-109390 response plan: inventory, patch to 8.0.3, restrict TCP 7070, hunt for compromise, govern remote-access tools]() ## Questions and answers ### Is CVE-2026-109390 being exploited in the wild? As of 19 October 2026, AnyDesk reports no evidence of active exploitation, and the CVE is not in the CISA KEV catalogue. Public PoC code exists, so this can change quickly. ### Does blocking port 7070 fully protect me? No. It reduces direct exposure only. Connections through the AnyDesk relay network may still reach the vulnerable code, so upgrading is mandatory. ### How do I check my AnyDesk version on Linux? Run anydesk --version in a terminal. Any result below 8.0.3 is vulnerable. ### Are Windows and macOS users at risk? The underlying flaw exists on those platforms, but there are no known exploits. AnyDesk advises updating to Windows 9.7.8+ and macOS 9.7.2+ as a precaution. ### What is AnyPwn? AnyPwn is the name of the public proof-of-concept exploit for this flaw, published by V12 Security on 8 October 2026. ## Sources - [CVE-2026-109390 record (OpenCVE / MITRE / NVD)]() - [CVE JSON record — CVEProject cvelistV5]() - [Qi-AnXin CERT analysis (Chinese)]() - [TheHackerWire CVE summary]() - [AnyDesk security advisory email, 16 October 2026; full advisory in the AnyDesk Trust Center]() - [AnyDesk official downloads]() --- Source: https://www.gowrishankar.me/blog/cve-2026-109390-critical-anydesk-linux-rce-what-it-is-and-how-to-respond