AnyDesk Printer COM Impersonation LPE - Unexpected Child Process (CVE-2026-43503)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•5

Detects the AnyDesk service-side printer worker process spawning suspicious child processes (e.g., cmd.exe, powershell.exe). This activity is indicative of exploitation attempts against CVE-2026-43503, where an attacker leverages the 'adprinterpipe' named pipe to send malicious COM marshaling bytes and impersonate the LocalSystem identity to escalate privileges.