A working exploit that runs commands as root on Linux machines running AnyDesk, without a login and before anyone approves the session, is now public. AnyDesk fixed the bug in version 8.0.3 in June 2026, but described the change only as a fix for an error that could crash the service, with no CVE identifier and no formal security advisory, so administrators had little reason to treat the update as urgent.
Peru's National Digital Security Center (CNSD) warned about the flaw in integrated digital security alert 197-2026, dated October 10. The bug goes by AnyPwn, the name the V12 security team used when it first announced an AnyDesk "preauth 0click RCE" on June 22 and said it would release proof-of-concept code after disclosure and a patch. According to CNSD, security researchers published the working exploit on October 8.
A 32-bit sum that wraps around
CNSD says the flaw sits in AnyDesk's session protocol, in the handling of "mode 5" stream packets. The code works out how much memory to reserve for incoming data without checking whether the 32-bit arithmetic overflows. AnyPwn sends a crafted payload length of 0xFFFFFFF0, and adding the 16-byte header wraps the total around, so AnyDesk reserves an undersized buffer while still recording the original length. That lets the exploit write past the end of the buffer, corrupt neighboring objects on the heap and then use a return-oriented programming (ROP) chain, which strings together snippets of code already in memory, to run arbitrary commands as root.
The demonstrated attack uses direct TCP connections to port 7070. It is probabilistic: success depends on how objects happen to be laid out in memory, and when conditions are wrong the AnyDesk service crashes instead of running the attacker's commands. The researchers also found that the vulnerable code path could be reached through AnyDesk's relay servers, but full exploitation that way has not been demonstrated.
Linux only, and only direct connections
Per CNSD, the vendor says the problem affects only direct connections on Linux, and that Windows and macOS are not affected. Older Linux versions may share the vulnerable code, but exploitation of them has not been confirmed. No CVSS score has been published because no CVE has been assigned, and the alert does not report exploitation in the wild.
Remote access tools make attractive targets because they are built to be reached from outside. Criminals already treat them as part of the battlefield, as with the WhiteLock ransomware that kills AnyDesk and TeamViewer to block recovery, and rival products have shipped their own security fixes, such as TeamViewer's five-flaw update. CNSD's coverage reflects how widely the tool is used, in Peru and elsewhere.
Update to AnyDesk 8.0.3 or later, and fence off port 7070
CNSD recommends:
- Updating AnyDesk for Linux to 8.0.3 or later, preferably the latest stable release
- Restricting TCP port 7070 with firewall rules to authorized addresses until every machine is updated
- Inventorying Linux systems that run AnyDesk and prioritizing those exposed to untrusted networks
- Monitoring AnyDesk logs and connections for unusual access, service crashes or commands run with elevated privileges
The patch has existed for almost four months. What changed in October is that anyone can now use the bug, and an update described as a crash fix is exactly the kind that gets left for later.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.