Back to overview

TRUMPF: Multiple products affected by Wibu CodeMeter vulnerability

VDE-2026-007
Last update
02/23/2026 09:00
Published at
02/23/2026 09:00
Vendor(s)
Trumpf SE + Co. KG
External ID
VDE-2026-007
CSAF Document
Download

Summary

The TRUMPF product versions listed below include a Wibu CodeMeter component that is vulnerable to a privilege escalation vulnerability through the CodeMeter installer on Windows.

Impact

The CodeMeter installer on Windows has a vulnerability that allows under certain circumstances an Escalation of Privileges for an unprivileged account. After installation on an unprivileged account with UAC using the built-in administrator account, CodeMeter launches the CodeMeter Control Center with system privileges.

Affected Product(s)

Model no. Product name Affected versions
Oseon 7.04.23, vers:semver/<8.00.00
Programming Tube vers:semver/<6.9, 6.8
TRUMPF License Expert vers:semver/<2.3.2, 2.2.2
TecZone Bend 25.10.0, vers:semver/<25.11.1
TruTops Boost vers:semver/<21.00.00, 20.04.23
TruTops Cell 2.69.29, vers:semver/<2.77.0
TruTops Weld vers:semver/<11.0, 10.0.133

Vulnerabilities

Expand / Collapse all

Published
02/23/2026 09:00
Severity
8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
Least Privilege Violation (CWE-272)
Summary

Wibu CodeMeter before 8.30a sometimes allows privilege escalation immediately after installation (before a logoff or reboot). For exploitation, there must have been an unprivileged installation with UAC, and the CodeMeter Control Center component must be installed, and the CodeMeter Control Center component must not have been restarted. In this scenario, the local user can navigate from Import License to a privileged instance of Windows Explorer.

References
cve.org | nvd.nist.gov

Remediation

New versions are available for the affected products. These include an updated WiBu CodeMeter (bundled with TRUMPF License Expert). If your installation is affected, the easiest fix is to install the latest TRUMPF License Expert from www.trumpf.com/en_INT/products/softwa....

Fixed Product Version
TruTops Boost 21.00.00
TecZone Bend 25.11.1
Oseon 8.00.00
Programming Tube 6.9
TruTops Cell 2.77.0
TruTops Weld 11.0
TRUMPF License Expert 2.3.2

Acknowledgments

Trumpf SE + Co. KG thanks the following parties for their efforts:

Revision History

Version Date Summary
1.0.0 02/23/2026 09:00 Initial version