Which versions of ASUS Armoury Crate are affected by CVE-2026-16727?

ASUS Armoury Crate contains a local privilege escalation vulnerability affecting ASUS consumer and gaming hardware that could grant unauthorized administrative access to threat actors with low-level…

How to fix or mitigate CVE-2026-16727?

Within 24 hours, identify and inventory all ASUS systems running Armoury Crate, prioritizing devices in privileged, development, or sensitive-data environments. Within 7 days, restrict local user account privileges via least-privilege policies, disable non-essential Armoury Crate services and scheduled tasks where operationally feasible, and enable file-system monitoring to detect suspicious file-substitution attempts. Within 30 days, establish a monitoring process for vendor patch announcements and develop a hardware refresh or replacement strategy if Armoury Crate cannot be safely isolated.

ASUS Armoury Crate CVE-2026-16727

Q: What is the CVSS score of CVE-2026-16727?

CVE-2026-16727 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-50946 HIGH

Race Condition (CWE-362)

2026-07-30 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

GHSA-479r-w7g7-fj9j

Race Condition RCE

7.3

CVSS 4.0 · Vendor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

Severity by source

Vendor (54bf65a7-a193-42d2-b1ba-8e150d3c35e1) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Local vector and existing low-priv account (AV:L/PR:L); the race window makes reliable exploitation timing-dependent (AC:H); privileged code execution yields full C/I/A impact with no scope change.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (54bf65a7-a193-42d2-b1ba-8e150d3c35e1).

CVSS VectorVendor: 54bf65a7-a193-42d2-b1ba-8e150d3c35e1

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 02:30 vuln.today

CVE Published

Jul 30, 2026 - 02:16 cve.org

HIGH 7.3

DescriptionCVE.org

Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Security Advisory for more information.

AnalysisAI

Local privilege escalation in ASUS Armoury Crate lets a low-privileged local user execute arbitrary code with elevated privileges by winning a race condition (CWE-362) and substituting a crafted file during a time-of-check/time-of-use window. The flaw affects the Armoury Crate system-management/control software bundled on ASUS consumer and gaming hardware, and although CVSS 4.0 rates it 7.3 (High), exploitation is local-only and requires precise timing (AT:P). There is no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

Armoury Crate is ASUS's unified Windows control-center application for managing RGB lighting, fan/performance profiles, driver and firmware updates, and Aura Sync on ROG/TUF laptops, desktops, and motherboards. It runs privileged background services and updater components, and CWE-362 (Concurrent Execution using a Shared Resource with Improper Synchronization) indicates a time-of-check-to-time-of-use (TOCTOU) defect: a privileged service validates or consumes a file whose path is writable or predictable by a lower-privileged user, allowing the file to be swapped between the check and the use. The 'crafted file replacement' vector in the description is the classic symptom of a privileged process operating on an attacker-influenceable filesystem location without an atomic, secure handle, so the attacker races to replace legitimate content with malicious content that the privileged process then acts upon.

RemediationAI

Update Armoury Crate to the fixed build published by ASUS - consult the 'Security Update for ASUS Armoury Crate' section at https://www.asus.com/security-advisory for the exact patched version (Patch available per vendor advisory; a specific fix version was not included in the input and should not be assumed). Until the update is applied, reduce local attack surface by restricting interactive/standard-user access to affected machines, since exploitation requires a local account; where the software is not needed, uninstall or disable the Armoury Crate background services (trade-off: loss of RGB, fan, and update management). As a hardening measure, apply least-privilege and application-allowlisting so an unprivileged user cannot stage or execute the crafted replacement file, and monitor for unexpected writes to Armoury Crate service/updater working directories (trade-off: tuning required to avoid false positives from legitimate updates).