---
title: AnyDesk for Linux "AnyPwn" (CVE-2026-109390): public pre-auth root exploit for a bug quietly fixed in June | ctxsec
url: https://ctxsec.com/items/anydesk-linux-cve-2026-109390
description: ""
status: "public exploit, no known in-the-wild use"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/anydesk-linux-cve-2026-109390.md)

public exploit, no known in-the-wild use

2026-10-14

### AnyDesk for Linux "AnyPwn" (CVE-2026-109390): public pre-auth root exploit for a bug quietly fixed in June

A heap overflow in AnyDesk's session protocol (mode-5 stream packets) lets an unauthenticated attacker run commands as root on Linux before anyone approves the connection (CVSS 9.8). Affects 8.0.0 up to 8.0.3; AnyDesk fixed it in 8.0.3 on June 23 but its changelog only said "fixed a bug that could lead to a crash," so CVE-based scanners missed it until the CVE landed this week. V12 Security's public exploit (Oct 8) targets 8.0.2 over direct TCP port 7070 and is probabilistic; relay-based exploitation is unproven. Windows and macOS are not affected. Censys sees 175,838 hosts exposing TCP 7070 (not confirmed vulnerable). Fix: upgrade Linux installs to 8.0.3+ (8.1.0 current) and block direct 7070 exposure.

Sources: [CVE-2026-109390](https://www.cve.org/CVERecord?id=CVE-2026-109390) · [Censys advisory](https://censys.com/advisory/cve-2026-109390/) · [AnyDesk Linux changelog](https://anydesk.com/en/changelog/linux) · [@censysio (exposure)](https://x.com/censysio/status/2110102414770516371)