- Engineer — Act: A public working exploit for a pre-auth root RCE means active exploitation risk is immediate; upgrade AnyDesk Linux to version 8.0.3 on all hosts and audit for any instances still running older versions.
- SOC/IR — Plan: No IOCs or active campaign reported yet, but working exploit publication typically precedes mass exploitation; build or tune detections for anomalous process spawning from the AnyDesk daemon on Linux endpoints and queue a hunt for lateral movement from remote-access tools.
- Leader — Plan: Confirm whether AnyDesk Linux is deployed in the environment and verify the patch is applied; the vendor’s deliberately vague changelog — no CVE, no security advisory — is a vendor-transparency red flag worth raising in your next vendor risk review.