AnyDesk Linux Pre-Auth RCE Exploit (AnyPwn) - Critical Vulnerability Analysis

In October 2026, security researchers published a working exploit called AnyPwn targeting a critical pre-authentication remote code execution vulnerability in AnyDesk Linux version 8.0.2. The flaw, silently patched in June 2026 with version 8.0.3, allows attackers to gain root access through a heap buffer overflow in the session protocol without requiring user approval. The vulnerability stems from improper 32-bit arithmetic overflow checking when calculating payload buffer sizes, enabling attackers to corrupt adjacent heap objects and execute arbitrary commands via ROP chains. Despite being patched months ago, AnyDesk provided no CVE assignment or security advisory, describing the fix only as a crash bug resolution.

This incident highlights the growing risk of silent security patches in remote access tools, particularly as hybrid work environments increase reliance on such software. The publication of working exploit code significantly raises the threat level for unpatched systems.

Remote access tools face increased scrutiny as attack surfaces expand in hybrid work environments. The silent nature of this patch and delayed exploit publication creates a dangerous window where organizations may unknowingly run vulnerable systems, especially given AnyDesk's widespread enterprise adoption.

Attackers exploit a pre-authentication heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2 via direct TCP connections on port 7070, achieving immediate root access without user approval. The vulnerability allows remote code execution through crafted session protocol packets that corrupt heap memory, enabling attackers to execute arbitrary commands as root and potentially establish persistent access or exfiltrate sensitive data from compromised Linux systems.

Kill Chain Progression

This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.

Attackers target AnyDesk Linux 8.0.2 via direct TCP connection to port 7070, exploiting heap buffer overflow in session protocol with crafted mode-5 stream packets containing payload length 0xFFFFFFF0 to achieve pre-authentication remote code execution

MITRE ATT&CK® Techniques

Exploit Public-Facing Application

Exploitation for Client Execution

Exploitation for Privilege Escalation

Exploitation for Defense Evasion

Sudo and Sudo Caching

Exploitation of Remote Services

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Software Security Testing

The heap buffer overflow vulnerability demonstrates inadequate security testing of custom payment processing applications, exposing systems to pre-authentication remote code execution attacks.

NYDFS 23 NYCRR 500 – Risk Assessment and Management

Failure to identify and remediate critical vulnerabilities in remote access tools represents inadequate cybersecurity risk assessment and management processes.

DORA – Identification of ICT Risk

Control ID: Article 8

The unpatched AnyDesk vulnerability exposes critical ICT systems to operational disruption through unauthorized root access, violating digital operational resilience requirements.

CISA ZTMM 2.0 – Network Traffic Inspection

Control ID: Network Security

Pre-authentication remote code execution on TCP port 7070 bypasses zero trust network segmentation and inspection controls, allowing unauthorized system access.

NIS2 Directive – Cybersecurity Risk Management Measures

Control ID: Article 21

The exploitation of unpatched software vulnerabilities in critical network infrastructure violates essential cybersecurity measures for supply chain security and incident prevention.

ISO 27001:2022 – Management of Technical Vulnerabilities

Delayed patching of known vulnerabilities and lack of proper security advisories demonstrates inadequate technical vulnerability management processes and controls.

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Critical exposure from AnyDesk Linux remote code execution vulnerability enabling pre-authentication root access, requiring immediate updates and network segmentation controls.

High-risk remote desktop compromise threatens zero trust architectures, encrypted traffic controls, and regulatory compliance for sensitive financial data protection.

Remote access vulnerabilities endanger HIPAA compliance and patient data security through lateral movement and privilege escalation attack vectors.

Pre-authentication root access exploit poses severe national security risks requiring enhanced threat detection, anomaly response, and secure hybrid connectivity measures.

Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access Verified

AnyDesk Linux Changelog - Version 8.0.3 Security Fix Verified

V12 Security - AnyPwn Proof of Concept Exploit Verified

AnyDesk Linux Downloads - Updated Versions Verified

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and Controls CNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the blast radius of this AnyDesk vulnerability by constraining lateral movement and exfiltration paths through network segmentation and east-west traffic controls.

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Network visibility and policy enforcement would likely detect anomalous connection patterns and traffic flows to port 7070, potentially constraining the attack surface through controlled network access paths.

Control: Zero Trust Segmentation

Mitigation: Workload-level segmentation policies would likely constrain the scope of root privileges to the compromised system boundary, reducing the effective reach of elevated access across the infrastructure.

Control: East-West Traffic Security

Mitigation: Microsegmentation and identity-aware routing would likely restrict lateral movement paths between workloads, constraining attackers from freely pivoting across network segments even with root access on the initial system.

Control: Multicloud Visibility & Control

Mitigation: Network traffic monitoring and policy enforcement would likely detect anomalous outbound communication patterns, constraining the establishment of persistent command and control channels through controlled egress paths.

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely constrain data exfiltration by limiting outbound network paths and monitoring large data transfers, reducing the volume and scope of data that could be extracted.

While the compromised Linux system remains at risk for local impact operations, the blast radius would likely be constrained to segmented network boundaries, limiting organization-wide damage potential.

Affected Business Functions

Remote Desktop Access

IT Support Operations

System Administration

Technical Support Services

Estimated downtime: 1 days

Pre-authentication remote code execution vulnerability allows attackers to gain root access to Linux systems running vulnerable AnyDesk versions without user approval. Potential exposure includes full system access, sensitive files, credentials, and the ability to establish persistent backdoors.

Key Takeaways & Steps

• Implement Zero Trust Segmentation to isolate remote access tools like AnyDesk and prevent lateral movement even after compromise

• Deploy Inline IPS with updated signatures to detect and block exploit attempts targeting known CVEs in remote desktop applications

• Enable Egress Security & Policy Enforcement to monitor and control outbound connections from compromised systems to prevent C2 establishment

• Utilize Multicloud Visibility & Control to detect anomalous remote access patterns and unauthorized root-level activities across hybrid environments

• Establish Threat Detection & Anomaly Response capabilities to baseline normal AnyDesk usage and alert on suspicious pre-authentication activities

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.